Travel Counsellors Ltd v Trailfinders Ltd: breach of confidence and the reasonable person

What happens when ex-employees of a competitor bring client information with them when they go to work with a new employer? In Travel Counsellors Ltd v Trailfinders Ltd [2021] EWCA Civ 38, the Court of Appeal held that an equitable duty of confidence on the new employer arises if a reasonable person would make enquiries about whether it is confidential, but the recipient fails to do so. 

The appellant argued that the judge had applied the wrong legal test in holding that the appellant owed an obligation of confidence to its rival in respect of the relevant information. According to the appellant, the equitable obligation would only arise if the recipient knew or had notice that the information was confidential. Whether it had notice of the confidential nature of the information has to be assessed objectively, by reference to a reasonable person standing in the recipient's position. And just because a reasonable person would make enquiries about whether the information (or some of it) was confidential was insufficient for an obligation of confidence to arise.

Arnold LJ, with whom Lewison LJ and Asplin LJ agreed, noted that there was surprisingly little authority. He cited his own judgment in Primary Group (UK) Ltd v Royal Bank of Scotland plc [2014] EWHC 1082 (Ch), as well as the Court of Appeal's decision in Racing Partnership Ltd v Done Brothers (Cash Betting) Ltd [2020] EWCA Civ 1300. On the basis of these cases he decided that:

... if the circumstances are such as to bring it to the notice of a reasonable person in the position of the recipient that the information, or some of it, may be confidential to another, then the reasonable person’s response may be to make enquiries. Whether the reasonable person would make enquiries, and if so what enquiries, is inevitably context- and fact-dependent. If the reasonable person would make enquiries, but the recipient abstains from doing so, then an obligation of confidentiality will arise

On the other hand, where the issue is accessory liability for misuse by another person rather than primary liability for misuse of confidential information, it may be necessary to show actual knowledge or turning a blind eye.

Cases like this are always fact-dependent, but the decision seems to place a significant burden on the recipient of information - although it does seem from the judgment that anyone offered information about clients in these circumstances really ought to sense that something is not quite right.

Whistleblowers' rights and breach of confidence: Pharmagona v Taheri

When a breach of confidence case has a 'whistleblower' dimension, things can get complicated. The history of Pharmagona Ltd v Taheri and Anor [2020] EWHC 312 (QB) (17 February 2020), which came before Mr Justice Nicol on 30 January (the judgment appearing on 17 February) is complicated - a sorry-looking tale of orders made and arguably not complied with - considering that it was nothing more than a simple breach of confidence action brought by an employer against a couple of employees, who happened to be husband-and-wife.

The defendants, IT manager and office manager respectively, had been summarily dismissed for stealing money by the claimant on 2nd February 2018, after which date they allegedly criminally hacked into the complainant's computer system and downloaded "various materials". The first defendant did the hacking, but communicated information to his wife who knew or ought to have known that she had confidential information.

The defendants maintained in their defence that the claimants had engaged in unlawful and criminal activities, including exporting goods to Iran. This, they argued, was why they were accused of theft and dismissed, although a police investigation had found no evidence against them. They claimed the protection of the Public Interest Disclosure Act 1998 and the Employment Rights Act 1996. Many elements make this a rather unusual breach of confidence case.

The defendants say that their hacking was to collect evidence of wrongdoing, and whistle-blowing would of course be immensely difficult if an injunction could be obtained to prevent information being passed on - indeed, to prevent the whistle being blown (or perhaps to remove its pea before blowing took place).

The claimant sought (so the judge inferred - the pleadings seem to have been somewhat unorthodox) an interim injunction. This would normally be dealt with according to the American Cyanamid principles, but the judge decided that s. 12 of the Human Rights Act applied: publication is not to be restrained before trial unless the court is satisfied that the applicant is likely to establish at trial that publication should not be allowed. The purpose of this provision is to protect the Convention right to freedom of expression (Article 10, of the European Convention on Human Rights of course). "Likely" means more likely than not, according to the House of Lords in Cream Holdings v Bannerjee [2004] UKHL 44, [2005] 1 AC 253, although this ordinary meaning might have to be applied flexibly sometimes.

The claimant argued that s. 12(3) did not apply, relying on the carve-out in Article 10(2) which allows freedom of expression to be curtailed to protect the rights of others - here, the claimant's proprietary rights in its confidential information. Counsel for the claimant pointed out that there had been no reference to Article 10 or s.12 in the key earlier Court of Appeal case Tchenguiz and Ors v Imerman (Rev 4) [2010] EWCA Civ 908 (29 July 2010) but the judge reckoned that the point about likely success at trial had been fully considered, even if the provisions had not been mentioned in so many words.

The judge was satisfied that unless the defendants were restrained, the claimant would be able to show at trial that the defendants would be likely to use the confidential information. However, the judge was also satisfied that the defendants should be free to co-operate with public authorities investigating the claimants' activities. They had, in short, to be allowed to blow their whistle. In the end, an injunction to prevent disclosure with a suitable public interest proviso, allowing the defendants to answer questions and provide documents, seems a very sensible (and in the circumstances quite simple) solution, and that is what the judge granted.

Sir Cliff Richard's expectation of privacy

I hope that the law on privacy is drifting away from its origins in the law on breach of confidence, if only for the selfish reason that I don't enjoy trying to lecture on or write about privacy as if it were part of the intellectual property world. Too often it seems to be concerned with little-known celebrities (spot the oxymoron) seeking to cover up their failings. But the chances of it appearing in exam papers just got a lot bigger than they already were.

Richard v The British Broadcasting Corporation (BBC) & Anor [2018] EWHC 1837 (Ch) (18 July 2018), a case which involved a genuine celebrity and a grievance that everyone should be able to acknowledge, suggests to me that the right to privacy is diverging from the law on breach of confidence, and I hope it will work out well for both areas of law. The claim was brought on the basis of Article 8 of the European Convention on Human Rights and also invoked the Data Protection Act 1998. Article 8 of course has to be balanced against Article 10, freedom of expression. So the questions for the court were, did Sir Cliff have a reasonable expectation of privacy in respect of the events reported, and was there a public interest in publishing the facts such that the BBC's Article 10 rights would prevail?

It's hard to imagine a more egregious (yes, that's my word of the day) invasion of one's privacy than to have the One O'clock News showing aerial footage of police officers swarming all over your house. But that's not what the court had to consider: only if Sir Cliff had a reasonable expectation of privacy would that have mattered. Mann J held that he did indeed have such an expectation, so he went on to balance the BBC's rights against that. The judgment contains a lengthy review of the various factors to be taken into account, but concludes that Sir Cliff's rights were, in effect, stronger than the BBC's. My reading of the judgment is that a highly persuasive part of this was the egregious nature of the breach. Some invasions of privacy can be regarded as minor, no doubt, but this was not one of them.

The judgment contains a long section devoted to the application of the rules about damages, and also a lot about contributions between the defendants. Life is not too short, but it is too full, to read all that at the moment. It contains nothing more about data protection, other than to mention it as part of the pleadings: damages would not be recovered twice over if there were a data protection breach, so perhaps the point is pretty well moot anyway, but I can't immediately see anything in the facts that would be actionable. What personal data were involved? What did the BBC or South Yorks Police do with any such data? Data protection legislation is obviously an important part of the scheme of protection for an individual's privacy, but this doesn't seem to be a case in which it adds anything.

Yesterday at Prime Minister's Questions, Anna Soubry MP (whom I knew quite well, many years ago) asked for government support for a bill she had introduced (if it's a new one, it seems to be in the same terms as one she introduced in 2010) to protect the privacy of people being investigated by the police. She proposed that it be known as Cliff's Law. Sorry, Anna, but the Copyright and Duration of Rights in Performances Regulations 2013 (SI 2013/1782) got there first.

The Prime Minister made the point (which has also been made by others, including The Guardian here) that revealing names can encourage other victims to come forward. (It can also, of course, encourage non-victims to take a chance too, but that's another issue.) That's hard to argue with, but in the context of the Richard case surely one could say that the suspect's reasonable or legitimate expectation of privacy, which is intact while the police are searching his house for evidence, is not nearly so strong when the police have begun to assemble a case, particularly if the case is a strong one. If there is (say) a reasonable chance that there are more victims who have not come forward, that further dilutes the expectation of privacy. I am no human rights lawyer, but this situation seems to be covered by Article 8.2, a carve-out for law enforcement purposes, and Article 10 is not the right provision on which to rely for this purpose - although I suppose the media would have to be able to rely on it even if 8.2 allowed the police to name names.

Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)

Car security isn't what it was when I was young. Leaving aside the fact that my old Frogeye didn't even have door locks (although there was a lock on the bonnet, so that might have foiled a thief, who'd have had to be pretty mad to go for a bright orange car in the first place)  let alone an immobiliser, even the locks on cars of that era left a lot to be desired. On a camping holiday with a schoolfriend and his family, he locked the keys to his Cortina GT in the boot, but his father (who ran a Ford dealership, although he himself drove a very exotic BMW 3.0CSi) opened it with the key to his caravan.

Nowadays, although there are still mechanical aspects to vehicle security, it's an area which has a great deal more to do with electronics. It was to protect the algorithm that lies at the heart of the security system it uses (along with several other manufacturers), the Magamos Crytpo chip, that Volkswagen found itself in court last week (Volkswagen Aktiengesellschaft v Garcia & Ors [2013] EWHC 1832 (Ch) (25 June 2013)).

The facts were quite simple. A handful of academics had "attacked" (as they say in the field) that security system, and discovered some flaws. The vehicle manufacturers who stood to be embarrassed by those flaws might, you'd think, be grateful, but the academics proposed to deliver a paper at a conference, and in doing so would reveal the key algorithm to the world. In the name of "responsible disclosure" they had not simply gone ahead and done this: they had talked to the proprietor of the confidential information concerned. But they hadn't talked to VW, not until much nearer the date of the conference (which was last week, hence VW's need to seek an interim injunction).

To do this, the academics used a program called Tango Programmer, produced by an organisation called Scorpio, which is based in Bulgaria, and purchased by the academics for €1,000. There is some discussion in the judgment of how the program was devised, and where its authors found the Megamos Algorithm, which they might have arrived at by "chip-slicing" - cutting open the chip and examining the gates under a microscope. The important question was whether the software was legitimate or not. As the judge observed, "Just because it comes from Bulgaria does not mean it is illegitimate." And the fact that the website (not available when I went looking for it the other day, but back on line now) was written in "broken English" did not persuade him. In fact the website looks plausible, and the products shown on suggest that this is a business of some substance; it appears to be a limited company, and the strangest thing about it is its location bang in the middle of Bulgaria.

There was an issue about VW's right to sue. The algorithm was devised by Thales, who were not initially a party to the action, but the judge added them as a "proper and necessary" party, saying that it was likely within the meaning of Cream Holdings Ltd & Ors v. Banerjee & Ors [2004] UKHL 44 (14 October 2004) that "the confidentiality in the Megamos Crypto algorithm belongs to them", which is an interesting way to express it. This point did not stand in the way of an injunction being granted: Thales had standing to sue, but the judge held that VW did too, as they had a legitimate interest in being a co-claimant.

There is an old Jacob J case, Mars UK Ltd v Teknowledge Ltd [1999] EWHC 226 (Pat) (11 June 1999), [1999] 2 Costs LR 44, [1999] EWHC 226 (Pat), [2000] FSR 138, on reverse engineering, in which he held that it was not a misuse of confidential information to reverse engineer a product you had bought even to obtain information encrypted for security. The present case was argued on the basis that that case had been correctly decided, though that is in dispute, and (of course) it was the claimants' submission that it did not apply because the Scorpio Programmer software was not legitimate. The judge ended up relying on the "murky" origins of the program and the lack of effort on the part of the defendants to ascertain whether it had been produced by legitimate reverse-engineering or otherwise, and on that basis he held that there would be a breach of confidence. Should an injunction be granted to prevent publication? Not merely to save VW's blushes, said Mr Justice Birss, considering Article 10 of the European Convention, section 12(3) of the Human Rights Act, and the Cream Holdings judgment (but not American Cyanamid, which he said was clearly not the right test in the circumstances), which gave the guidance that the standard for not allowing publication is a flexible one, and that the court should be "exceedingly slow" to make interim orders if it is not satisfied that the claimant will probably succeed at trial.

Thales or VW would, he thought, probably succeed at trial, so that hurdle was cleared. Then the balance of public interest and the public interest defence fell to be considered. Freedom of expression and academic freedom were very important, but the epidemic of car crime that would be unleashed if the algorithm were published was more important. The software is sold by someone who understands that it can facilitate crime: there's a disclaimer that says (sic)

All devices and software developed by Scorpio-LK Ltd. are designed and sold with legal purpose to enchance and help people working in the sphere of car repairs and maintenance. The company doesn't take responsibility for any misuse of our products for illegal purpuses. Hence persons misusing our products for illegal purpuses bear their own responsebility for such acts.

And elsewhere:

Scorpio-lk Ltd accepts no responsibility for misuse of software for illegal purposes. The purchased softawre can only be used to repair vehicle immobilisers. On purchase of software client accepts responsibility for software use rendering Scorpio-lk Ltd unaccountable for illegal use.

The English, incidentally, seems no more broken than that of many native speakers. But the judge concluded that the claimants would probably be able to show that the software was not legitimate, and the defendants should have appreciated that.

The judge granted the injunction sought by VW, requiring "redaction" (the trendy alternative to "editing") of the paper they had written. They could still impress their peers by showing that they had derived the algorithm, and the claimants could remedy the problem identified with it: win win. The judge clearly came to the view that the defendants' protestations about "reasonable disclosure"  were nothing more than self-justification, and not the actions of responsible academics - a harsh view, but consistent with their reluctance to take even a few simple steps to ascertain where Scorpio-Lk Ltd had found the algorithm.

Force India: breach of confidence, but no more damages

Force India Formula One Team Ltd v Aerolab Srl & Anor [2013] EWCA Civ 780 (03 July 2013)  is perhaps the judicial equivalent of being relegated to the back of the grid after being found to be 1.5 kg overweight. Certainly it's a second, arguably self-inflicted, misfortune in only a few days to be visited on Force India, who nevertheless are knocking ever harder on the door that leads to the front end of grand prix motor racing.*

The appeal was from a judgment of Arnold J, ([2012] EWHC 616 (Ch) (21 March 2012)) who had awarded Force India damages which failed to meet the team's claim, falling short by three orders of  magnitude. The Court of Appeal dismissed the appeal: the award was proportionate and dissuasive (amounting to the profit made by the defendants). Interestingly Lewison LJ said he was "sceptical" about whether the enforcement directive applied to breach of confidence actions, though even if it did he did not think the award breached the directive.

The dispute dates back to August 2009, when the defendants started to work for Team Lotus, which began campaigning in the 2010 season (though under the name Lotus Racing at first), before being obliged to change its name to Caterham for the 2012 season after the Chapman family changed sides. The use of the Lotus name also gave rise to litigation - and to Peter Smith J's expression of regret that the parties were not fighting things out on the racetrack but in the courtroom. Unfortunately for Team Lotus/Caterham, on the track they never come within striking distance of their opponents in the court (except when Paul Di Resta is obliged to start from the back of the grid and has to pass what are still often called the "new teams").

In the present case, of course, Caterham were not a party. Nevertheless, they were the indirect beneficiary of the breach of confidence, and therefore an indirect target of the litigation - which perhaps shows how times change in grand prix motor racing: Force India have not been consistently near the front but they have had their moments over the years, while Caterham's best years are, I hope, ahead of them - they are a couple of years behind Force India, which started racing in 2008, although it can trace its history back to the launch of the Jordan team in 1991. Even in 2010 Force India were miles ahead of the new teams. From Force India's point of view, was the backmarker worth (as litigators say) powder and shot?

* I use the expression deliberately, in protest against the appropriation as a trade mark of the title of the applicable set of rules and its use as the name of the series of races.

Supreme Court on trade secrets

In Vestergaard Frantsen A/S (now called MVF3 ApS) v Bestnet Europe Ltd and others [2013] UKSC 31 (22 May 2013) the Supreme Court took a narrow view of a former employee's duty of confidence. It did not extend to stuff that she did not know was confidential, or to abuses of the information of which she was unaware.

Trine Sig, the former employee, had worked for the claimants and then set up the defendant company in competition with them. The co-founder of the new company, unknown to Ms Sig, had some of the claimant's trade secrets which he was misusing. At first instance, Arnold J held her liable for breach of confidence. Seager v Copydex [1967] 1 WLR 923 established that one can be liable for breach of confidence even if not aware of the breach. He relied on the confidentiality obligations in her contract of employment, and on her close involvement in setting up the defendant company and in its activities.

The Court of Appeal, where the leading judgment came (naturally) from Jacob LJ, overturned part of the first instance judgment, and the Supreme Court (Lord Neuberger giving the leading judgment) upheld the Court of Appeal.

Before the Supreme Court, the claimants argued that obligations of confidentiality arose under Ms Sig's contract of employment, as a result of her 'common design' with her business partner, and because she either turned a blind eye to his activities or played with fire. None of these lines of reasoning impressed the Supremes.

Lord Neuberger was not prepared to imply into the contract of employment a term that Ms Sig would not assist another person to abuse the claimant's trade secrets where she knew of neither the trade secrets nor the abuse. To accept that argument would be almost to impose strict liability, and would be wrong.

The claimant's most strongly-argued line was that there was a common design. Lord Neuberger drew a comparison with a driver who conveys a robber to a bank. Only if the driver knew why the robber wanted to go to the bank would there be a common design: ignorance would be a defence, and again to hold otherwise would be to impose strict liability.

The absence of dishonesty on the part of Ms Sig defeated the "blind eye" argument, while the "playing with fire" scenario might help to show that there was dishonesty, but merely taking the risk of bringing in the co-founder did not make her liable.