Search warrants and privacy in Ireland - CRH, Irish Cement & Lynch v. CCPC

The High Court gave a very important judgment yesterday (Independent.ie story) on the issues raised by the use of a search warrant to seize an entire email account where many of the emails in the account were not caught by the terms of the warrant. To grossly simplify a complicated decision, Barrett J. held that where the Competition and Consumer Protection Commission (CCPC) had seized an entire email account it was not itself entitled to carry out a "sifting" exercise to determine which emails fell within the scope of the warrant - instead, this had to be done by some impartial vetting process. In the lack of a suitable statutory mechanism, this could be done by agreement between the parties.

The full decision isn't yet on the courts.ie site, but courtesy of the CCPC I've uploaded a scanned copy to Scribd. The full decision will need careful consideration, but at first glance it's a very privacy protective decision which may have far reaching consequences in other areas of criminal procedure. Notably, it cites with approval the 2013 Canadian Supreme Court decision in R. v. Vu on the special privacy issues presented by searches of computers. (And, I'm glad to see, the Digital Rights Ireland litigation.) By requiring specificity in what is seized and how that material is then examined, it puts a question mark over other search powers - such as those under s.48 of the Criminal Justice (Theft and Fraud Offences) Act, 2001 - which are generally used so as to seize an entire computer and not merely specific records.

Discovery of encrypted documents

Today's Irish Times has a story arising out of the Quinn litigation against the state which raises important issues around access to encrypted documents:

The family of Seán Quinn is demanding access to three letters sent between former minister for finance Brian Lenihan and then chairman of Anglo Irish Bank Donal O’Connor as part its €2.34 billion claim against the state.  This correspondence relates to late January 2009 and early February 2009, just after the state took the decision to nationalise Anglo as it tottered on the brink of collapse. The family also wants efforts to be made to crack a password-protected email sent by the bank’s chief executive David Drumm to Matt Moran, a close lieutenant, in the midst of the financial crisis in April 2008, according to documents filed in relation to their legal battle...

Legal advisers to the liquidators of IBRC, who are now in charge of Anglo, are refusing to release about 168 documents which they claim are legally privileged, with the exception of the email from Mr Drumm to Mr Moran which they cannot access... [The Quinns] have asked the liquidators of IBRC to instruct IT experts to crack the encoded email or give it to the family so that they can try to do so.

I've already looked at the encrypted Anglo files from a criminal law perspective, considering when police can demand that files be decrypted or that individuals hand over passwords. This case presents parallel civil law issues - when can a party in litigation demand that potentially relevant files be decrypted as part of the discovery process, when the other party does not have the relevant passwords?

This will be the first time this is considered by the Irish courts. There doesn't appear to be any case law on the topic, and it's not explicitly addressed in the Rules of the Superior Courts. It's also not considered in the Law Reform Commission's (rather disappointing) 2009 Consultation Paper on Documentary and Electronic Evidence. The closest Irish material is the 2013 Good Practice Guide to Electronic Discovery in Ireland which suggests that parties making discovery should if necessary attempt to break the protection on encrypted or password protected files (PDF, p.23).

I look forward to seeing the decision on this point.

Defamatory material on Facebook and YouTube: McKeogh v. Doe and others

The High Court today gave a significant decision in McKeogh v. Doe and others concerning defamatory material posted through Facebook and YouTube. The background to the case is well summarised by the Daily Mail. As I have a professional involvement I'll refrain from any comment except to explain that this is an interlocutory judgment (i.e. pending a final hearing of the action) in which Peart J. held that a mandatory injunction should be granted against Facebook and the Google defendants requiring them to take down material defaming the plaintiff until the full trial can take place. The judgment did not itself grant an injunction - instead, the details of the injunction will be determined following a meeting to take place between experts for the plaintiff and the defendants. After this meeting the experts must report back to the court with either an agreed report or separate reports regarding the technical steps which can be taken to remove the defamatory material as far as reasonably possible.

Full text of the judgment:

High Court orders Quinns to reveal passwords to receiver

In an interesting decision the High Court (Kelly J.) yesterday ordered that members of the Quinn family must provide passwords to personal email accounts and other information to a receiver appointed over their assets. The order was made in support of the injunctions already granted aimed at recovering assets following a "mesmerisingly complex" asset-stripping scheme in breach of court orders.

This is significant and may well be the first time an Irish court has made an order requiring a party to civil litigation to reveal their passwords to the other side - while there's extensive caselaw in the related area of electronic discovery, none of the reported cases seem to have required the production of passwords. [Update - the ever knowledgeable Andy Harbison tells me that this isn't in fact the first case where an Irish court has made an order requiring that passwords be disclosed - this has been done in at least one Anton Piller order, though unfortunately there's no reported judgment.]

Given the invasiveness of the procedure - especially the fact that personal emails would be involved - the court built in protections into the order, so that:

[T]he information must only be seen by the receiver and a named solicitor..

The judge approved a protocol proposed by the receiver for obtaining and categorising information from the phones and computers. It involves material being downloaded in the presence of the Quinn defendants by a representative of a company hired by the receiver.
That material will then be categorised by the receiver into three categories -- relevant and not privileged, irrelevant, and apparently privileged. Disputes over privilege issues will be decided by the court.

More details in the Irish Times|Irish Independent.

For the related issue as to whether password disclosure can be compelled in criminal matters see this post from 2010.)

New rules for electronic discovery in Ireland

Statutory Instrument No. 93 of 2009 has made some significant changes to electronic discovery in Ireland. McCann Fitzgerald have summarised the effects:

* a party may seek electronic data in searchable form from its opponent;
* the court may order a party to give inspection and search facilities for electronic data on its computer systems to the other side;
* where computers contain sensitive non-discoverable data, the court instead may order that an independent expert carry out the inspection and search for relevant electronic data (the party seeking that discovery will have to fund the expert’s costs and expenses);
* where a party giving discovery finds that searching for the documents or data is excessively costly or burdensome, it may apply to the court to seek to narrow the scope of the discovery order;
* a party giving discovery must list the documents or data according to agreed categories or in a sequence corresponding with the manner in which the documents or data has been stored or kept in the usual course of business – the intention is to make discovery more comprehensible;
* all parties giving discovery must swear in an affidavit of discovery that they understand their obligation to give discovery of documents and electronic data (within the categories of discovery agreed or ordered by the court) which may help or damage their case in any way.

Interestingly, although the new rules provide for parties to be obliged to allow the other side "inspection and searching facilities", they appear to apply only to existing documents. They don't seem to refer to the question of whether the court can order a party to carry out analysis of ("data mine") electronic records - thus leaving unaltered the effect of the ruling in Dome Telecom v. Eircom.

Supreme Court ruling on electronic discovery - Orders may extend to extracting and analysing data

In an important decision - Dome Telecom v. Eircom - the Supreme Court has held that the courts, as part of the discovery process, have the power to order a litigant to carry out data analysis to extract, collate and analyse records from a database and to produce a report containing that information. While this is not the first case on this point (the High Court made a similar order in 2006 in Used Car Importers of Ireland v. Minister for Finance) this is the first case to consider the issue in detail and the first time that the matter has been ruled on by the Supreme Court.

By way of background, Irish law on discovery is contained in Order 31 of the Rules of the Superior Courts, which gives the courts power to order parties to disclose to the other side those "documents" which are relevant and necessary to the case. This rule has been applied without difficulty to situations where what is sought is a specific document stored in electronic format - cases such as Clifford v. Minister for Justice have accepted that computer files should be regarded as "documents", and electronic discovery is now common.

What presented a problem in Dome Telecom was the traditional understanding of discovery as being limited to disclosure of existing documents. As Fennelly J. put it:

"a court will only order discovery of documents or records which exist. If no record has been made of a relevant conversation, meeting or event, a court will not, for the purpose of discovery, require a party to make one."

Here Dome Telecom alleged that Eircom had damaged its call card business by charging on a discriminatory basis for calls made from mobile phones to its 1800 freephone number. To put a figure on the damage suffered, Dome Telecom sought discovery of the total number of minutes of calls made to specific 1800 freephone numbers operated by its competitors. This was granted by the High Court, notwithstanding Eircom's claims that this would go beyond merely disclosing an existing document, but would require it to engage in an expensive analysis and filtering process to create an entirely new document. Eircom appealed, claiming:

1. That the power of the High Court to order discovery of documents does not extend to directing a party to create documents for the purposes of the action.

2. That the power of the High Court to order discovery of documents does not extend to directing a party to create documents that do not exist at the time that the order for discovery is made.

3. That the creation of the documents directed by the High Court imposes a disproportionate burden on the appellant where an order to comply with that order it would be required

(a) to extract in excess of 20 billion call data records from the tapes on which they are currently stored;

(b) to record the said records onto a parallel data base;

(c) to collate and analyse the records on the parallel data base in order to correlate them with the 1800 freephone numbers the subject matter of the order for discovery;

(d) to create therefrom a document containing a report of the total monthly volume of freephone minutes traffic per month from the 1st July 2000 to the 7th April 2005 in respect of each 1800 number by reference to access method by the appellant to international carriers – limited for the time being to those identified and set forth in the Schedule where the volume of minutes trafficked to that international carrier in any given month exceeded 5,000 minutes.

On appeal, the Supreme Court agreed by a majority (Fennelly and Kearns JJ, Geoghegan J dissenting) that the discovery was unnecessary and disproportionate in the particular circumstances of the case. However, on the matter of principle - whether the court could make an order of this type, and whether this amounted to requiring a party to create an entirely new document - the majority (Fennelly and Geoghegan JJ, Kearns J reserving his position) rejected the arguments of Eircom and held that the court could make orders requiring a party to analyse data in their possession and to present it in a certain form. Per Geoghegan J:

The Rules of Court are important and adherence to them is important but if an obvious problem of fair procedures or efficient case management arises in proceedings, the court, if there is no rule in existence precisely covering the situation, has an inherent power to fashion its own procedure and even if there was a rule applicable, the court is not necessarily hidebound by it. It is common knowledge that a vast amount of stored information in the business world which formerly would have been in a documentary form in the traditional sense is now computerised. As a matter of fairness and common sense the courts must adapt themselves to this situation and fashion appropriate analogous orders of discovery. In order to achieve a reasonable parity with traditional documentary discovery it may well be necessary to direct a party "to create documents" within the meaning of the notice of appeal. It may indeed also be necessary to direct a party "to create documents" within the meaning of the notice of appeal even if such "documents" "do not exist at the time the order is made". I am deliberately using quotation marks because I do not intend to adjudicate on the quasi-metaphysical argument of Mr. Paul Anthony McDermott, counsel for the respondent, that the "documents" do in fact "exist". At any rate that matter can probably be argued both ways but I would be firmly of opinion that an order of discovery can be made which involves the creation of documents which do not exist, made in the kind of context in which it is sought in this case. Otherwise, potential litigants could operate their business computers in such a way that they would be able to evade any worthwhile discovery.

This promises to be a very significant decision, and will certainly make electronic discovery more attractive for litigants while at the same time increasing the burden on those from whom discovery is sought.