Court Orders for the Preservation of Computer Data

June 30, 2001

Imagine an intended lawsuit. The claimant is to be a trading company that has just learnt that a recently departed former employee has joined a competitor. The competitor is to be the defendant. The claimant’s reason for wishing to sue is that it has a strong suspicion that the defendant is knowingly making use of confidential computer data wrongfully disappropriated from the claimant by the former employee. The data might be the copyright source code of proprietary application software, or lists of customers with their preferences, or lists of prices with discounts offered to particular customers, or some other information which the claimant regards as valuable and confidential. If the information has been purloined, it is almost certainly to be found on a computer being used by the defendant. Requesting the defendant to give disclosure of incriminating computer files will not be effective. The request in itself gives the defendant the opportunity to remove and hide the incriminating material on a different computer at a secret location. It is easy to imagine other scenarios in which the same problem arises.

Throughout the last 25 years those advising the claimant would consider making use of what is now called a ‘Search Order’. The claimant applies to the court without notice to the defendant. If the court grants a search order, the claimant then conducts a ‘dawn raid’ on the premises ofthe defendant. The procedure has its advantages for the claimant, but also has serious disadvantages. The claimant’s advisers must spend considerable time and effort checking and rechecking that the evidence to be presented to the court in support of the application for the search order will not inadvertently mislead the court. If it did so, the defendant would be entitled to apply to the court for the search order to be set aside, and for the claimant to pay the defendant’s costs on the indemnity basis. A search order is expensive to enforce, because of the need to plan to arrive early in the day with sufficient helpers to carry out the search (at least one of whom will probably need to be a computer expert) and because of the need to engage an independent supervising solicitor. Enforcement tends for obvious reasons to be very disruptive of the defendant’s business and, although this may be welcomed by the claimant, there is a practical risk that the claimant may have to recompense the defendant for lost business if the raid fails to produce evidence confirming the claimant’s suspicions. Indeed, the court may well be reluctant to grant a search order atall if it is likely to give the claimant access to data which the defendant might assert was its own confidential information. All these consideration sought to make anyone hesitate long and hard before applying for a search order.

It is possible to obtain effective relief from the court with less expense, less risk, and less disruption to the defendant’s business than is involved with a search order. Of course there will always be cases in which a search order is still the only remedy worth seeking, but in most cases there is an alternative procedure. It has two main stages. Initially the claimant applies to the court, without giving the defendant notice, for an order by way of injunction requiring the defendant to lodge information and computer data with the defendant’s own solicitors. If the order is granted, it is served on the defendant together with notice of the further application that initiates the second stage of applications on notice,starting with an application on notice for the computer data to be disclosed on a confidential basis to an expert engaged by the claimant. Subsequently the claimant may need to apply for the computer data to be disclosed to the claimant itself. Each of these stages needs further explanation.

Application Without Notice

At the first stage, the claimant applies without notice for a preservation order by way of injunction. The requisite draft order might contain(after the usual recitations “Upon application made …”, “Upon … “,and “Upon reading …”) provisions to the following or similar effect:



1. The directors of the Defendant shall immediately upon service of this Order upon the Defendant identify to solicitors instructed on behalf of the Defendant:

1.1 by make, model, serial number and location, every computer under the control of the Defendant and used by theDefendant in the course of the Defendant’s business;

1.2 by file name and size in bytes, all computer files created and/or used in the course of the Defendant’s business including but not limited to those containing any of the following information, namely:

1.2.1 the source code of any proprietary  application software of the Claimant;

1.2.2 the identity of actual and potential customers of the Defendant;

1.2.3 the detailed requirements of such customers;

1.2.4 the prices charged or to be charged to such customers;

1.3 by class and approximate quantity, all printed or written documents created and/or used in the course ofthe Defendant’s business and containing any of the information specified in paragraphs 1.2.1 to 1.2.4 above.

2. The Defendant shall immediately upon service of this Order provide to such solicitors to hold until further order of the Court:

2.1 a computer-readable copy or legible print-out of each of the computer files referred to in paragraph 1.2 above;

2.2 originals or photocopies of the documents referred to in paragraph 1.3 above.

3. For the avoidance of doubt this Order is made without prejudice to any contention on the part of the Defendant that any material the subject of this Order should not be disclosed to theClaimant.


4. The costs of:

4.1 the application for this Order;

4.2 complying with this Order;

shall in each case be reserved for future adjudication.


The Defendant may apply to the Court at any time to vary or discharge this Order but if it wishes to do so it must first inform the Claimant’s Solicitors in writing at least 48 hours beforehand.”

An order in this or similar form hasthe advantage for the claimant that it is not necessary as with a search order to stake everything on a raid of the defendant’s premises, and the claimant does not have to risk having to return important evidence to the defendant because the claimant has made an inadvertent mistake. For the defendant the advantages are that at this initial stage there is minimal interference either with the defendant’s business or with the defendant’s own confidential information. The defendant’s business is obviously not disrupted to the extent that it would be if a search order was being executed. Compliance with the order proposed is not particularly onerous for the defendant.

The defendant ought already to have in place a procedure for taking backup or archive copies of its software, so that copying all the files onto tape or diskor some other computer readable medium is something that needs to be done regularly for security purposes. It ought to be accomplished within a short time. Printing out all the files is likely to be a much more difficult, time-consuming and expensive task, and it is hard to see why any defendant would prefer to do it, but there is no harm in allowing the option. Providing a directory of files with the size of each file in bytes should also be relatively straightforward, since all modern computer operating systems enable files to belisted by name, date and size in bytes.

Peter Susman QC

Printing out such a list also ought to be accomplished within a short time. The defendant’s own confidential information is protected because at this initial stage the order does not permit the claimant to examine the defendant’s confidential and secret computer files. It expressly preserves the right of the defendant to argue against disclosure, and gives the defendant time to make considered arguments, rather than having to react instantly to an unexpected emergency, with the wrong decision risking proceedings for contempt of court.

Conversely, the order requires immediate compliance, so that a miscreant defendant has very little time to remove incriminating material and provide non-incriminating material in its place. For example, it would not be practical for a dishonest defendant to construct non-incriminatory customer lists or price lists before handing the material over to the defendant’s own solicitors. Once the material has been provided to the defendant’s own solicitors, any non-incriminatory customer lists or price lists constructed by the defendant will need to have the identical number of bytes in each file. It is simple to change the name and contents of a file, and relatively simple to back-date the changes, but ending up with exactly the same number of bytes is in practice virtually impossible to achieve in a short time.

The court’s power to grant a preservation order in this form is arguably best derived from CPR 25.1(c)(i), which provides that the court may grant the interim remedy of an order for the custody or preservation of relevant property. The argument is that ‘property’ is obviously wide enough toinclude computer files. An alternative justification is that a computer file is a ‘document’ for the purpose of disclosure under CPR 31, since CPR 31.4 provides that for that purpose ‘document’ means anything in which information of any description is recorded. Both approaches were upheld under the comparable provisions of the old rules in Cv PBM [1995] 2 CLY 4109 (HH Judge Malcolm Lee QC sitting as Mercantile Judgein Birmingham). The plaintiff C was a company whose business was selling computer peripherals and consumables by telephone to users in the UK. C sued the defendant company PBM for an account of profits made by PBM by the alleged misuse of valuable and confidential information relating to the customers of C’sbusiness. Former employees of C, now working for PBM, were said to have copied the information from C’s computer database, in breach of terms ofconfidentiality in their contracts of employment with C. PMB was said to have used the information in the knowledge that it had been wrongly copied from C’s computer database. PBM denied that there had been any copying, and insisted that it had no computer database itself, although it admitted that it used word processing of invoices and similar documents. The judge held that an order could be made for disclosure of any computer files as “documents”discoverable under RSC Order 24, r7(2), or as “property” that could be inspected under RSC Order 29, r2, or under the inherent power of the court. The same approach was adopted in KettlewellFuels Ltd v North Yorkshire Fuels Ltd (unreported, 28 February 1997: HHJudge Fox-Andrews QC, Official Referee); and in Premier Products Support Services Ltd v Jones (unreported, 5 March 1998: HH Judge Richard Havery QC, Official Referee). In each of these three cases the judge accepted that a persuasive reason for granting the order sought was that there would be less disruption to the defendant’s business and less threat to the defendant’s own confidential information than with a search order.

If it is resolved to apply for such an order as is proposed, the technical nature of the relief being sought makes an obvious choice of forum in London and elsewhere the specialist Technology and Construction Court. It is not always realised that this Court is able to try, as well as cases that would otherwise be heard in the Queen’s Bench Division of the High Court or in a county court (such as contract disputes), also cases that would otherwise be heard in the Chancery Division (such as intellectual property disputes): see Practice Direction – Technology and Construction Court [2000] Civil Procedure (White Book), Vol 2, section 2E. In other circumstances, the Commercial Court of the Central London County Court Business List might be more appropriate, and outside London one of the Mercantile Lists. Other cases might seem more suitable for a non-specialist Court with jurisdiction, namely the Queen’s BenchDivision, or the Chancery Division, or indeed any county court.

The application will need to be supported by one or more witness statements setting out the facts relied upon. The main or a subsidiary witness statement should be made by the claimant’s solicitor, and might perhaps conclude with paragraphs to the following or similar effect:

“It is submitted that in these circumstances the Claimant would be entitled to seek the assistance of the Court for the purpose of searching the Defendant’s premises and seizing material containing the Claimant’s confidential information. However, it is recognised that this extreme remedy might not only severely disrupt the Defendant’s business but also compromise potentially confidential information of the Defendant.

The Defendant therefore seeks the assistance of the Court by asking the Court to make an order in the first instance and without having heard the Defendant, requiring the Defendant merely to preserve computer and documentary files by identifying them to and lodging copies with its own solicitors.

I know that the Defendant has in the past instructed Messrs Sue Grabbit & Runne to act on its behalf, because … If the order is made, I would of course inform Messrs Sue Grabbit& Runne as soon as practicable after the Defendant is served by faxing a copy of the papers served to them, and I offer an undertaking to do so.

If the order is made, the Claimant proposes to serve with it the Application Form a draft of which forms Exhibit “AB 6” to this witness statement, seeking an order that the material secured be subjected to independent expert examination and comparison with the equivalent material of the Claimant. This comparison ought to reveal whether or not the Defendant is using copies of the Claimant’s confidential information. The Application Form also sets out the safeguards proposed by theClaimant.

I ask the Court to grant the Claimant interim relief accordingly.”

The draft application form to be exhibited to this witness statement is one seeking on notice the relief explained under the next heading of this article.

The order works best when the defendant already has a reputable solicitor acting on the defendant’s behalf. However, if the defendant has no solicitor, the claimant’s solicitor might consider the following alternative course. Before making the application without notice for the injunction, the claimant’s solicitor could approach one or more suitable firms of solicitors local to the defendant in order to ascertain whether such firms might act for the defendant if asked to do so by the defendant. The claimant’s solicitor making the witness statement in support of the application could then include in the witness statement a paragraph identifying the solicitors concerned, and stating that they are prepared to consider acting if instructed by the defendant. The claimant’s solicitor could also offer an undertaking that when the injunction is served specific mention will be made of this opportunity to the defendant.

The Applications OnNotice

As already mentioned, notice of a second stage hearing should beserved on the defendant at the same time as the injunction obtained at the first stage hearing. If possible the second stage hearing should have been pre-arranged to follow seven days or so after service of the injunction.

The application form could ask for an order in the following or similar terms, namely that:

1. The Defendant disclose to the Claimant in accordance with the provisions of paragraph 3 below the following identifications made by the Defendant to the Defendant’s solicitors pursuant to [the Injunction granted on [date],paragraph 1 … (or as appropriate)]

2. The Defendant disclose to the Claimant in accordance with the provisions of paragraph 3 below the following material provided to the Defendant’s solicitors to hold until further order of the Court pursuant to [the said Injunction, paragraph 2 … (or as appropriate)]

3. Such disclosure be made for the purpose of examination and comparison with the equivalent material of the Claimant on terms that:

3.1 such examination and comparison of the Defendant’s and the Claimant’s respective material be conducted by an independent expert in information technology nominated by the Claimant and at the option of the Defendant jointly with an independent expert in information technology nominated by the Defendant or a partner or employee of the Defendant’s solicitors;

3.2 the place and time of such examination and comparison be agreed between the parties and in default of agreement fixed by the Court on application for that purpose;

3.3 there be no representative of the parties present at such examination and comparison other than any expert nominated in accordance with paragraph 3.1 above and any of the parties’ respective legal advisers;

3.4 any such expert and any of the parties’ respective legal advisers present at such examination and comparison be required to give in advance an irrevocable written undertaking that in reporting the results of such examination and comparison and their general conclusions they will keep the information contained in the Defendant’s and the Claimant’s respective material confidential so far as practicable and pending further order of the Court;

3.5 following such examination and comparison the Defendant’s said material be returned to the Defendant’s solicitors to hold until further order and the Claimant’s said material be returned to the Claimant’s solicitors to hold pending further order.

4. The costs of this application and of such examination and comparison be costs in the case.”

Although either party or the court might propose that a single expert be appointed to report, the proceedings will by now inevitably be at an acutely adversarial stage, and it is therefore suggested that it would in almost every case be more just and satisfactory to permit each party to instruct a separate expert. After all, the parties are likely to want separate advice. So even if the court might prefer one expert in place of two, imposing a single expert at this stage is likely to result in there being three experts in place of two.

In the discussion above of the basis of the court’s jurisdiction to make the injunction in the first place, reference was made to three cases in which the respective judges held that there was jurisdiction to grant the injunction, and did so. None of those cases proceeded to an expert inspection of the computer files. In each case, relatively soon after the injunction was served, the defendant made an approach to settle the dispute on terms advantageous to the claimant, and further proceedings were unnecessary. It is anticipated that this would be a common if not frequent outcome.

If an expert inspects, compares and reports, and the parties have still not yet come to terms, the claimant then needs to apply to the court for an order that the experts be permitted to reveal detailed information to the party instructing them. The form in which such an order is sought, and of the witness statement in support, will depend on the circumstances of the particular case.


Although there are cases where nothing less than a full search order will do, in very many cases the alternative procedure proposed in this article offers a method of achieving the same result with less expense and less risk to the claimant, and with greater protection for the defendant’s business and the defendant’s own confidential information.

Peter Susman QCpractices IT law from Chambers at 4 Field Court, Gray’s Inn, WC1R 4EF.