Publishing confidential information online: Twitter oversteps boundaries

In a precedent move likely to have implications for all entities that publish confidential information online, the NSW Supreme Court recently ordered Twitter to provide information on an anonymous twitter troll and that there be a restraint from publishing or republishing the offending tweets globally. 

This case also serves a reminder of the risk of a strategy which relies solely on a defence of a lack of jurisdiction, without a back up substantive argument.

Facts

An anonymous troll tweeted confidential information about X (a company whose identity has been suppressed), along with threatening remarks.  The identity of the author of the tweets remained unknown, but it was evident that they had access to some of X’s financial records.  It was clear and not in dispute that the information disclosed via the tweets was confidential.

X requested Twitter take down the tweets and provide for information about the tweeter.  Twitter agreed to remove some of the tweets, but not all.  This was on the grounds that they did not violate Twitter’s Terms of Service.  Twitter also refused to provide any information about the tweeter, citing its Privacy Policy.

In response, X brought proceedings in the NSW Supreme Court to enjoin Twitter:

1. from continuing to publish X’s confidential information on its platform;
2. to removing the remaining offending tweets; and
3. to compel disclosure identifying information on the tweeter.

Twitter chose not to take part in the proceedings, claiming that the Court did not have the jurisdiction to bind it.

Decision

The Court granted the injunction against Twitter.

Jurisdiction

The Court found that the international reach of publications on Twitter was significant enough to justify it having jurisdiction and to enable the granting injunctive relief.

The Court referred to the Court rules which permitted service out of jurisdiction without the need for leave where the injunction is sought to compel or restrain conduct in Australia.  X was seeking to restrain Twitter’s conduct internationally, and accordingly the Court had jurisdiction.  Whether Twitter decided to submit to the jurisdiction was irrelevant.

Further, in the absence of any evidence from Twitter, the court found that it was both reasonable and appropriate to make orders that impose a requirement of some degree of filtering, or checking, by Twitter to ensure that X’s confidential information does not get posted, and posted information gets removed.

Injunctive relief granted

The Court considered whether, even though it had the jurisdiction, it should exercise its discretion to make the orders sought.  This involved a question of form, onerousness and practical utility.  In making this decision, the Court considered:

1. the broad nature of the orders sought, in terms of unlimited timing and subject matter, and blanket prohibitions for the tweeters;
2. that Twitter asserted that it was not feasible for it proactively to monitor user content;
3. the utility of making the orders sought where compliance with them in other jurisdictions could not be guaranteed by a clear right of enforcement; and
4. public interest. 

The court granted final injunctive orders that Twitter:

1. be restrained from publishing the offending tweets anywhere in the world on their twitter platform or website;
2. remove the offending tweets already published anywhere the world;
3. remove the tweeter’s account “to the intent that such person or persons, to the extent known by the defendants, be prevented from operating any account with the defendants”, and be restrained from notifying the twitter of the removal of this account; and
4. provide X with information on the troll’s account – including user names, IP address, phone number and location.

Lavan Comment

Foreign digital entities are clearly not necessarily outside the scope of Australian courts.  Twitter’s gamble in simply arguing that the court lacked jurisdiction, and failing to actively participate in proceedings, is a risky approach which did not pay off in this case.  Where the content of wide-reaching disseminations is sufficiently serious to justify making orders which extend out of the jurisdiction, the courts will do so.

Entities publishing confidential information online should also be aware that the courts will not shy away from intervening where it considers it appropriate and reasonable, and making orders imposing requirements of filtering, or checking, to ensure that other’s confidential information either does not get posted or posted information gets removed.