The High Court has upheld claims of breach of confidence, inducing breach of contract and unlawful means conspiracy against a 'middle man' who bought (and sold on) personal data that had been unlawfully accessed and retained by an Aviva employee (Aviva Insurance v Oliver)

Facts 

Miss Carruthers, an employee of Aviva, unlawfully accessed personal data of accident victims from Aviva’s computer systems and sold this information to Mr Oliver, who in turn sold it to claims management companies. These companies then contacted Aviva's customers about their accidents.

Aviva’s customers complained to Aviva about the unsolicited contact, leading Aviva to launch a remediation team to inform policyholders of the breach, answer queries, provide reassurance and collate information about the contact made (costing Aviva approximately £108,000). 

Criminal proceedings were brought against Carruthers and Oliver; both pleaded guilty to an offence under the Data Protection Act 1998 (DPA).  Aviva also issued a civil claim against Oliver for:

• breach of confidence;
• inducing breach of contract; and
• unlawful means conspiracy whereby Oliver and Carruthers acted in concert to harm Aviva using unlawful means (breaches of the DPA and breaches of confidence).

Oliver denied liability claiming he was not aware that the information had been obtained wrongfully. The question for the court was whether Oliver knew that Carruthers was providing him with information which she had obtained improperly from her employer. 

Decision

The court first considered the approach to be taken to assess the evidence, which was largely statements and exhibits prepared for the criminal proceedings (including a statement made by Carruthers to the police and a record of police interviews). The court made it clear that it would exercise very considerable caution before attaching any weight to the account Carruthers gave of Oliver's actions and knowledge, as it was clearly in her interests to minimise her wrongdoing. The court found Oliver's evidence and lack of recollection to be unpersuasive, instead it referred to the contemporaneous documents. 

The court assessed whether Aviva had shown, on the balance of probabilities, that Oliver had the knowledge alleged. Ultimately, Oliver was provided with reports within a short time of the accidents and he knew that he was receiving and selling data which had been reported within this very short timeframe. Aviva also pointed to WhatsApp exchanges which it said could only be explained on the basis that Oliver knew that Carruthers worked for an insurance company and that she was giving him information obtained by accessing her employer's computer system. 

The court found that Oliver knew Carruthers worked for Aviva and that he knew that the information being provided to him had been obtained by Carruthers accessing Aviva's systems whilst she was at work, illegitimately and without authority. This was the only realistic explanation of the evidence.

• Breach of confidence - The court considered that the information obtained was clearly confidential and Oliver had knowledge he had obtained the confidential information improperly.
• Inducing breach of contract - The court found the actions of Carruthers to be in breach of contract of the express term of confidentiality in her employment contract and that even without that, her actions would have been in breach of the duty of fidelity.  Oliver knew that the information for which he was paying Carruthers had been obtained from her employer without authority, establishing liability. 
• Unlawful means conspiracy - The court found liability flowed from the finding that Oliver knew Carruthers was providing him with wrongfully obtained information. 

Aviva sought damages based on the remediation efforts for the torts of conspiracy and inducing breach of contract, but also an account of profits made by Oliver for the breach of confidence claim. 

To prevent double recovery for a single loss, the court concluded that Aviva could not be compensated more than once or in multiple ways for the same wrongdoing. Given the lack of frankness from Oliver as to the profits made, that Aviva did not wish the matter to be prolonged by a formal accounting exercise, the court concluded that there would be a risk of injustice to Oliver in taking a robust broad brush approach to the assessment of profits and instead awarded damages to the amount of the remediation efforts. 

Comment

This case serves as a useful reminder on the need to evidence knowledge on the part of the wrongdoer to be able to prove allegations of fraud to the civil standard. It is an example of the approach of the courts with regard to hearsay evidence, and the court's reliance on contemporaneous documents when faced with (potentially irrelevant or untrusted) hearsay evidence and a lack of tangible witness evidence. 

Addleshaw Goddard is recognised as the market-leading Business Protection Practice. Our team’s work focuses on advising organisations on team moves and helping employers to manage the risks stemming from employees and third parties who pose a threat to their legitimate interests, by taking action to enforce the employer’s rights and protect confidential information ranging from securing undertakings or obtaining injunctive relief, to pursuing claims for damages/loss of profits.

For further information about our Business Protection Practice, please contact: