Key Facts
- •Global Processing Services (UK) Limited (Claimant) sought summary judgment against Vladimir and Alla Yanpolsky (Defendants) for breach of confidence.
- •The breach involved the alleged misuse and/or disclosure of confidential data (Disclosed Data) from a cyber-attack investigation.
- •The Disclosed Data, originally part of an exhibit in a criminal trial against Vladimir Yanpolsky, contained sensitive cardholder information.
- •The Defendants sent multiple emails to various parties (ICO, police, card companies, etc.) alleging a data breach and threatening to contact cardholders.
- •The Claimant argued that the Defendants' actions constituted a breach of confidence, despite the Defendants claiming public interest and/or acting in preparation for an appeal.
Legal Principles
Breach of confidence requires: (1) information with the necessary quality of confidence; (2) imparted in circumstances importing an obligation of confidence; (3) unauthorised use to the detriment of the communicating party.
Coco v A.N. Clark (Engineers) Ltd [1969] RPC 41
Whether an implied undertaking exists when used material is disclosed to a defendant in criminal proceedings.
Mahon v Rahn [1998] Q.B. 427, CA; Taylor v Director of the Serious Fraud Office [1999] 2 A.C. 177
Public interest exception to breach of confidence; subjective intentions are not determinative.
Toulson & Phipps on Confidentiality, 4th Edn., paragraphs 5-103 to 5-118
Purpose exception to breach of confidence; whether a subjective or objective test applies when used material is disclosed in criminal proceedings.
Criminal Procedure and Investigations Act 1996, section 17(2)(b)
Outcomes
Summary judgment for the Claimant.
The Defendants had no realistic prospect of successfully defending the claim. Their actions constituted a breach of confidence; the Disclosed Data had the necessary quality of confidence, was imparted in circumstances importing an obligation of confidence, and the Defendants' use and threatened use was unauthorized and detrimental to the Claimant.
Injunction granted.
The injunction prohibits the Defendants from using, preserving, disseminating, or disclosing the Disclosed Data and requires delivery up and destruction of any documents containing the data. This was necessary to prevent the Defendants from carrying out their threatened actions, despite the data having already been delivered up previously.