Digital Evidence and Imaging Orders: Practical Considerations

March 25, 2024

by Steven Fennell

 

Overview

Commercial practitioners will be familiar with search orders, formerly known as Anton Pillar Orders, which permit the search of paper records.  Such searches were typically intrusive and extremely expensive, involving many hours of work on the part of the search team and supervising solicitor, particularly where there were disputes as to relevance and privilege.  In TBD (Owen Holland) Ltd v Simons [2020] EWCA Civ 1182, the Court of Appeal set out detailed guidance on the use of imaging orders which allow the applicant to take an image of electronic data. Because such data can be imaged without being read, the issue of interrogating that data can be left for a later hearing on notice.  Imaging is therefore typically less intrusive and very often less costly than an old-style search order.

A standard form imaging order is now included at Annex B to CPR PD 25A.

This article summarises the main legal principles, highlights the key provisions of the standard form order and addresses some practical points which may arise.

The Law

Section 7(1) of the Civil Procedure Act 1997 gives the court the power to make an order for preservation of evidence.  Key points include:

  • The order can be made against third parties (Abela v Fakih [2017] EWHC 269 (Ch) at [29] – [30]).
  • It can be made on a without notice application (eg Wild Brain Family International Ltd v Robson [2018] EWHC 3163 (Ch)).
  • A preservation order for electronic material is not a search order and in particular does not compel the respondent to permit the applicant to enter his home or other properties. However, a compelled search of an individual’s virtual life is capable of being almost as intrusive as a compelled search of his home (Wild Brain Family International Ltd v Robson [2018] EWHC 3163 (Ch) at [15] – [16]).
  • The threshold for the exercise of the court’s power is a “real possibility” of destruction of evidence and not a finding that the respondent is more likely than not to destroy/conceal evidence (analogous with the “real possibility” test of dissipation for a freezing order) (Wild Brain Family International Ltd v Robson [2018] EWHC 3163 (Ch) at [23] and Abela v Fakih [2017] EWHC 269 (Ch) at [32]).
  • An order against a third party will never be granted as a matter of routine. It will only be granted where the circumstances justify it (Abela v Fakih [2017] EWHC 269 (Ch) at [32]).
  • As with all such applications, the court must ask itself whether a lesser order would be appropriate.

In TBD (Owen Holland Ltd) v Simons [2020] EWCA Civ 1182 at [192] – [193], the Court of Appeal highlighted the distinction between the preservation of evidence and the subsequent examination of the evidence preserved.

“The basic safeguard required in imaging orders is that, save in exceptional cases, the images should be kept in the safekeeping of the forensic computer expert, and not searched or inspected by anyone, until the return date. If there is to be any departure from this, it will require a very high degree of justification, and must be specifically and explicitly approved by the court. On the return date, consideration must be given to the timing and methodology of disclosure and inspection of documents captured in the images. The presumption should be that it will be for the defendant to give disclosure of such documents in the normal way, but this presumption may be departed from where there is sufficient justification. Even if the presumption is departed from, there should be no unilateral searching of the images by or on behalf of the claimant: the methodology of the search must be either agreed between the parties or approved by the court.”

In Re Valorem Holdings Ltd [2023] EWHC 2625, the High Court dealt with an imaging order made against individuals involved in an unfair prejudice petition.  On that occasion, the order related to the individuals’ mobile phones.  The court set out the following test, taken from the case-law relating to search orders.

  • There must be an “extremely strong” prima facie case.
  • The damage, potential or actual, must be very serious for the applicant.
  • There must be clear evidence that the respondents have in their possession incriminating documents.
  • There must be a real possibility that the respondents may destroy such material before any application on notice can be made.

The Application and the Standard Form Order

An application for an imaging order will almost always be made without notice and heard in private.  It must be heard by a High Court judge: district judges, masters and ICC Judges do not have the power to make such orders.  There is detailed guidance at paras 15.42 to 15.61 of the Chancery Guide. The Commercial Court Guide does not give equivalent guidance, noting at para F.14.10 that search orders (and by implication imaging orders) are rare in the Commercial Court. Solicitors applying for an imaging order in the Commercial Court are unlikely to be criticised if they follow the provisions of the Chancery Guide as appropriate.

Practitioners will be familiar with the usual obligations of full and frank disclosure on an application made without notice.  A particular feature of an application for an imaging order is that will often be necessary to amend the standard form order included at Annex B to CPR PD 25A, particularly where the respondent is an individual, not an organisation.

  • Para 6(a) requires the Applicant to provide a definition of “the Information”, i.e. the evidence to be preserved, and provides for imaging of all physical storage devices which contain “Information”. The draft order refers to USBs, mobile telephones, PDAs, tablets, computers, laptops, internal or external hard disks, compact discs, magnetic tapes, electronic files, back-ups, and servers.
  • Para 6(b) requires the Respondent to provide “effective access” to any online accounts in its control which contain “Information”, including but not limited to email accounts, online accounting or payment systems, online storage platforms or cloud services, online message services and online bank accounts which contain the Information. The draft allows the Applicant to insert details of known online accounts.
  • Para 6(c) requires the Respondent to provide account information, usernames, passwords, two-factor authentication and the like.

The Applicant and its advisors will need to think very carefully whether all of these provisions are actually necessary, in particular where the Respondent is an individual.  If the evidence in question is (for example) emails, electronic messages via messaging applications such as WhatsApp and Telegram, text messages and the like, it may be unnecessary and oppressive to include provision for searching of devices other than telephones and tablets.

The standard form order provides for service by a supervising solicitor, but it does not include the provision at paragraph 10 of the standard form search order which allows the Respondent to seek legal advice and to ask the supervising solicitor to delay starting the search for up to two hours.  It is not obvious why this provision has not been carried across into the new standard form imaging order. It would be prudent to raise this issue with the court at the without notice hearing and to consider whether it should be included in the order applied for.

Para 12 of the standard form order contains a note that the order should normally provide for service on a weekday and not before 9.30 am, so as to allow the Respondent to take legal advice.  That may be impractical if the Respondent is an individual.  The author has obtained an imaging order against an individual who was known to work as a driver, and in that case the court was willing to permit service at 6 am, on the basis that the order was to include wording analogous to paragraph 10 of the search order, with a longer time to allow legal advice to be taken.

The court should be referred to the analogous provisions of doorstep delivery up orders, which expressly prohibit any entry onto the respondent’s premises.  Again, that needs to be addressed in the evidence and the draft order.  Does anyone actually need to set foot inside the respondent’s premises?

Practical Points

The following points may be useful on any application.

  • Identify precisely who the Respondent(s) should be. Think about whether orders are needed against more than one individual or corporate body.
  • It is possible to obtain orders against third parties as well as defendants to the underlying litigation.
  • Ensure that you address the four requirements set out in Re Valorem Holdings Ltd [2023] EWHC 2625 in the evidence in support.
  • If you are seeking orders against individuals, it may well be obvious that their devices and online accounts are likely to contain personal and private material irrelevant to the litigation, but you still need to spell that out in the affidavit in support.
  • Address the practical implications of the order with the supervising solicitor and the forensic IT expert. Who is going to attend, where and when do they need to be there, what practical provisions are needed if the order does not permit entry onto the respondent’s premises and the imaging might have to be done in the forensic IT contractor’s vehicle?
  • Consider whether the applicant should have any devices/accounts imaged and preserved by the same forensic IT expert now, so as to avoid any risk of loss of data between now and disclosure.
  • Think about what exposure might arise from the cross-undertaking in damages. Imaging is unlikely to cause anything more than temporary disruption to the respondent in most cases because the order envisages the devices and accounts being returned to the respondent after the imaging has been done, but respondents might argue that even temporary disruption is costly, and/or that there has been reputational damage.  The evidence in support needs to address the assets available to meet any claim under the cross-undertaking.
Back to News