Court of Appeal upholds judge’s order for disclosure of material on personal phones

The Court of Appeal has ruled that an order requiring disclosure of materials on a personal phone was lawful. The judge had correctly balanced privacy rights with the interests of justice.  

In Phones4U Ltd v EE Ltd & others, the Court of Appeal considered an order for disclosure in civil litigation relating to the personal devices of current and former employees. The devices were used to send and receive work-related emails. The case concerned an allegation of conspiracy to injure by unlawful means, with the alleged acts taking place on employees’ personal devices.

The judge's order

The High Court judge ordered the defendant employers to request their employees to provide their devices to an IT consultant (engaged by the defendant employers) to search for work-related communications. The consultant had undertaken not to disclose other material to the defendant employers or their solicitors, to delete copies and to return the devices, ensuring that interference with the individuals’ privacy was kept to a minimum. The defendants appealed the order.

Court of Appeal rejects appeal 

The Court of Appeal upheld the original order, stating that judge had properly balanced the privacy rights of the individuals under Article 8 of the European Convention of Human Rights against the interests of justice. The Court noted that the order was a proportionate and reasonable solution, particularly as the case involved an alleged unlawful covert agreement. 

The Court of Appeal regarded the mechanism prescribed by the order as appropriate and proportionate to ensure that in cases of collusive behaviour the Court did not become powerless to resolve issues fairly. It considered that the voluntary nature of the order was enough to strike an appropriate privacy balance. If the individuals had refused to hand over their phones, the Court acknowledged that some other approach would have to be adopted.

The Court also addressed the allegation that the use of the data was prohibited by the GDPR. It rejected the argument, noting that the IT consultant, if considered a data controller, would have obtained consent, as compliance was voluntary. In any event, the processing was necessary to comply with a legal obligation placed on the controller. 

Comment

While the case concerned an unusual set of facts, it confirms that in some instances personal devices may be searched in litigation proceedings. The method adopted in this case had taken the personal privacy rights of the employees into account and the use of an IT consultant and the undertakings given achieved the required balance with the interests of justice.