If through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers. Justice requires that he should co-operate in righting the wrong if he unwittingly facilitated its perpetration. This is the principle recognized by the House of Lords in Norwich Pharmacal Co v Customs and Excise Commissioners  AC 133.
This principle has been considered by the Supreme Court in Rugby Football Union v Consolidated Information Services Ltd (formerly Viagogo Ltd)  UKSC 55. This case arose in the following way.
The Rugby Football Union (RFU) is of course the governing body for Rugby Union in England. It owns Twickenham Stadium. It is responsible for issuing tickets for matches played at the Stadium. It is the RFU’s policy to allocate tickets so as to develop the sport and enhance its popularity. Most tickets are distributed via affiliated rugby clubs and other bodies. The distribution thereafter is subject to different rules depending on the nature of the body in question. Member clubs are permitted to sell some or all of their ticket allocation to official licensed operators for use in corporate hospitality packages. The RFU’s terms and conditions stipulate that any resale of a ticket or any advertisement of a ticket for sale at above face value will constitute a breach of contract rendering the ticket null and void. This condition is printed on the tickets and applicants are warned of it on ticket application forms. A further term stipulates that the tickets are property of the RFU at all times.
Viagogo (now in liquidation) operated a website which provided the opportunity for visitors to the site to buy tickets online for a number of sporting and other events. Sellers would register their tickets with Viagogo and a price would be suggested based on current market data. Viagogo received a percentage of the sale. The RFU monitors ticket re-sale websites in an attempt to discover whether and by whom tickets were being sold above face value. This effort was frustrated, however, in many instances by the anonymity offered by websites including Viagogo.
In the run up to the international rugby matches in autumn 2010 and the Six Nations Tournament, the RFU discovered that Viagogo had been used to advertise thousands of tickets for the matches at Twickenham. Tickets with a face value of £20 to £55 were being advertised for sale at up to £1300. After a request for information about the identity of those selling the tickets was refused, the RFU issued proceedings against Viagogo seeking information which it required in order to take action to protect its policy in relation to tickets.
The High Court granted the RFU a Norwich Pharmacal order requiring Viagogo to disclose the identities of those involved in the sales. The order was made on the grounds that the RFU had a good arguable case that those selling and purchasing the tickets had been guilty of breach of contract and that it was appropriate to grant the order for them to obtain redress.
Before the Court of Appeal, Viagogo introduced a new ground of appeal to the effect that granting the order represented a disproportionate interference with the rights of the potential wrongdoers under Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 guarantees the protection of personal data. The Court of Appeal  EWCA Civ 1585 upheld the decision of the High Court and decided that the RFU had no readily alternative means of pursuing the wrongdoers. On the new ground the Court of Appeal held that interference with the personal data rights of the individuals was proportionate in light of the RFU’s legitimate objective in obtaining redress for arguable wrongs.
The issue before the Supreme Court was whether the grant of the order involved a breach of Article 8 of the Charter. The Supreme Court unanimously dismissed the appeal.
The Supreme Court observed that cases since Norwich Pharmacal itself have emphasized the need for flexibility and discretion in considering whether the remedy should be granted. It is not necessary that an applicant intends to bring legal proceedings in respect of the arguable wrong. Any form of redress (for example disciplinary action or the dismissal of an employee) will suffice to ground an application for the order. The need to order disclosure will be found to exist only if it is a necessary and proportionate response in all the circumstances. The test of necessity does not require the remedy to be one of last resort. The essential purpose of the remedy is to do justice. This involves the exercise of discretion by a careful and fair weighing of all relevant factors.
Various factors have been identified in the authorities as relevant. These include: (i) the strength of the possible cause of action contemplated by the applicant for the order; (ii) the strong public interest in allowing an applicant to vindicate his legal rights; (iii) whether the making of the order will deter similar wrongdoing in the future; (iv) whether the information could be obtained from another source; (v) whether the respondent to the application knew or ought to have known that he was facilitating arguable wrongdoing; (vi) whether the order might reveal the names of innocent persons as well as wrongdoers, and if so whether such innocent persons will suffer any harm as a result; (vii) the degree of confidentiality of the information sought; (viii) the privacy rights under Article 8 of the ECHR of the individuals whose identity is to be disclosed; (ix) the rights and freedoms under the EU data protection regime of the individuals whose identity is to be disclosed; and (x) the public interest in maintaining the confidentiality of journalistic sources, as recognized in s10 of the Contempt of Court Act 1981 and Article 10 of the ECHR.
As Lord Kerr stated (para 18), many of these factors are self-evidently relevant to the question of whether the issue of a Norwich Pharmacal order is proportionate in the context of Article 8 of the Charter of Fundamental Rights of the European Union. Article 8 of the Charter was applicable as the order of the High Court involved disclosure of private data and thus was in the material scope of European Law.
The Supreme Court held that the appropriate test of proportionality under Article 8 of the Charter involved weighing the benefit of the information being sought by the RFU against the impact that disclosure was likely to have on the individual concerned. The appellant was wrong to suggest, however, that the assessment had to be carried out solely by reference to the particular benefit that obtaining information in relation to an individual might bring. It was artificial and unrealistic to suggest that the RFU’s aim of discouraging others in the future from flouting its rules should not be considered. The facts of each case must be considered individually, but there was nothing in the European cases cited or otherwise which supported the notion that the wider context for which the RFU wished to have the information should be left out of account.
While there should be an intense focus on the rights claimed by the individuals concerned, this was not a case where disclosure would result in oppressive or unfair treatment. The only information sought was the names and addresses of individuals who had bought and sold tickets in clear breach of the RFU’s ticket policy. The particular circumstances affecting a person whose data were sought may in some limited cases displace the interests of the applicant for disclosure even where there was no feasible alternative way of getting the information. This was not such a case, however.