High Court of Ireland Decisions

[2020] IEHC 281

THE HIGH COURT

 [No. 2020 3945 P]

BETWEEN

HEALTH SERVICE EXECUTIVE

PLAINTIFF

AND

NEILL BRADLEY

DEFENDANT

Ex Tempore judgment (No. 2) of Mr. Justice O’Connor delivered on the 5th day of June 2020

1.       The notice of motion which has been issued and served in accordance with the directions given on the 1st June 2020 seeks a number of orders restraining the defendant from disseminating or using confidential information. The defendant has neither engaged a legal representative nor attended in court despite service of a copy of the order from last Monday, the notice of motion, together with the affidavits and exhibits referred to therein.

2.       The plaintiff has established to the satisfaction of this Court that there is a probability that the plaintiff has gained access to sensitive and private data through his former involvement as a contracted systems administrator for an automated dispensing cabinet system in various hospitals. Moreover, he has threatened to facilitate the dissemination of details about patients and their private records which he has characterised in one cautionary tweet to potential users as having been stolen. 

3.       The plaintiff is concerned about the breach of privacy rights and the breach of its confidential information which it has sought to secure since first alerted about the activities of the defendant whose employment was terminated on the 19th May 2020 by the contractor engaged by the plaintiff. The interim Chief Information Officer of the plaintiff had been alerted to a tweet linked to the defendant which had a screenshot of a gateway to the servers of the plaintiff. The plaintiff concluded that the posted screenshot had to emanate from someone in the employment of its contractor whose role is to maintain the dispensing product.

4.       The plaintiff has adduced evidence on affidavit about the attempts to minimise the effect of the breach of obligations by the defendant. Despite those efforts, the defendant has continued to threaten the dissemination of data which he alleges that he accessed and can provide. 

5.       The affidavits, starting with the affidavit of the Chief Information Officer for the plaintiff, sworn on the 1st June, and which was relied upon at the ex parte application for interim relief also, describes the potential for misuse by the defendant of information which he himself has mentioned in a tweet as “stolen”. He effectively warned people with whom he is corresponding, that they may be dealing with stolen information. In other words, the defendant knows that he should not facilitate access to the data which he remains obliged to keep secure.

6.       The Court remains alert to ensure that the constitutional rights of parties are vindicated with the constitutional obligation to have matters heard in open court fulfilled.

7.       Counsel has also referred the Court to recent communications which the defendant has generated that disclose his intention to leave the jurisdiction having sold and moved from his house today.  He has most recently tweeted about moving to Europe in a camper van to “ply my skills elsewhere”. The defendant has evinced an intention to give access to the data from abroad and to avoid the jurisdiction of this Court and other authorities to enforce rights. Moreover the order sought in the notice of motion to deliver up all records and devices containing the confidential information will be set at naught, according to the plaintiff, if the Court does not grant an order with a view to keeping the defendant in the jurisdiction.

8.       In that regard Counsel relies on the judgment of Kearns J. (as he then was) delivered in J.N. and C Limited v T.K. and J.S. trading as M.I. and L.T.B. [2003] 2 ILRM 40 and Bayer A. G. V Winter 1986 1 WLR 497 as authority for seeking this type of relief. This Court finds that the defendant has created exceptional and compelling circumstances which merits an order in the style sought. The Court is not punishing the defendant but rather exercising its jurisdiction for the proper and effective administration of justice for the shortest possible time. If the defendant has a good and lawful reason for leaving the jurisdiction, the Court is enabling him to apply to the Court for leave to depart by the terms of the order to be made now. The terms of the order which the Court sets out below having given the legal representatives for the plaintiff an opportunity to comment upon before finalising, are largely self-explanatory in the context outlined earlier. In view of the limited time available today, I indicated when delivering this judgement that the typed version of the judgement which I dictated in Court would be expanded upon for clarity sake when produced for reading.

9.       The defendant will be given an opportunity at the plenary hearing of these proceedings to articulate any defence. Further directions and an early trial may be facilitated if one or other party applies. The defendant also has liberty to apply to this Court in the meantime for relaxation of the order or any part thereof for good and sufficient reason explained on affidavit. I emphasise that the material which has prompted this application, the threats of the defendant and his actual statements through various means of communication have indicated a serious breach of his obligations to his former employer and contractor to the plaintiff and more significantly the patients of the plaintiff. The rights of the plaintiff and its patients require the Court to make the following orders with publication of this judgment having a number of redactions of the actual perfected order to assist in protecting privacy rights. The Court considers that the redacted details are not necessary to understand this judgment whereas the redacted detail may be required for the enforcement of the perfected order:-

“(i)     An interlocutory injunction restraining the defendant and any person to whom the defendant has communicated or may communicate “the Confidential Information” (described in the first part of the Schedule hereto) from disseminating, publishing, communicating by any means whatsoever, or otherwise making any use of the Confidential Information or any part thereof for any purpose whether through the use of the specific twitter handles and email addresses set out in the second part of the schedule or otherwise.

(ii)      An interlocutory injunction restraining the defendant and any person who has received the Confidential Information from the defendant, directly or indirectly, from destroying, deleting or causing the deletion of the Confidential Information or any part thereof until further order of the Court.

(iii)     An order directing the defendant to deliver up to the plaintiff’s solicitors all documents, records and devices containing the Confidential Information and/or to submit such devices for forensic analysis of the records.

(iv)     An order pursuant to Section 28(8) of the Supreme Court Judicature (Ireland) Act, 1877, restraining the defendant from leaving the jurisdiction until he has complied with the order requiring the defendant to deliver up according to Order (iii) above and to deliver his passport to An Garda Síochána forthwith (such passport to be retained by An Garda Síochána until further order).

(v)     Liberty to the plaintiff’s solicitors to notify the Department of Foreign affairs, An Garda Síochána, port authorities and authorities for other exits points from the State about these orders and particularly the order restraining the departure of the defendant from the jurisdiction

(vi)     Liberty for the defendant to apply to this Court to vary any or all of the above orders by giving 48 clear hours email notice to the plaintiff’s solicitors to make such an application grounded upon an affidavit by the defendant.

          AND THE COURT notes the undertaking of the plaintiff’s solicitors at the request of the Court to furnish to the Data Protection Commissioner, the Minister for Health and the Attorney General with a copy of this Order and the affidavits for this application if requested by those parties.

          AND IT IS ORDERED that the Statement of Claim be delivered to the Defendant by email by 5pm on the 15th day of June 2020.

          All service of notices and affidavits to be effected by sending to the email addresses used by the parties for communicating with each other to date in these proceedings

          Reserve the issue of costs for the applications to date to the next sitting of the Court which will determine any application in these proceedings

SCHEDULE

First Part

          “Confidential Information” means:

(i)      Any information obtained by the defendant through the use of the [redacted] system as used by the plaintiff;

(ii)      Any information obtained through the use of the plaintiff’s [redacted] secure portal or [redacted] system and/or databases;

(iii)     Any information contained in the [redacted] mentioned at para. 42 of Mr. Thompsons affidavit sworn on the 1st June 2020;

(iv)     Any personal data relating to patients of the plaintiff;

(v)     Any information from the plaintiff’s [redacted] databases;

(vi)     The stolen medical data referred to in the defendant’s tweet of the 18th May 2020 at 12:41pm and the medical databases allegedly sent to [redacted] by the defendant in accordance with the tweet of the 1st June 2020 at 8.15pm.

Part 2

          Twitter Accounts and email addresses:

(i)      [Details redacted for publication of this judgment].        ”

          The Court had already noted the usual undertaking as to damages given by Counsel on behalf of the plaintiff

Result:     Interlocutory injunction granted to protect data including patient information along with order restraining the defendant from leaving the jurisdiction until he delivers up devices and records.