Insurance firm Admiral fails to grab phone location data of 'fraud' claimant's mother
- Reference: 1639743911
- News link: https://www.theregister.co.uk/2021/12/17/admiral_insurance_phone_data_court/
- Source link:
The Court of Appeal of England and Wales' previously unnoticed decision comes as a similar one in Germany this week raises questions about the use of the law against third-party providers of tech services.
Vodafone did not object to Admiral's application for a Norwich Pharmacal order (NPO) in November 2020 to obtain call records of someone who was not an insurance customer – with Admiral's barrister telling judges that mobile phones "have enabled people to lie about their whereabouts."
[1]
Handing down their [2]judgment late last month, Lord Justices Baker and Lewis together with Mr Justice Francis upheld an earlier ruling refusing Admiral access to cell site location data about the mother of a man who held an insurance policy with the company.
[3]
[4]
Admiral (a trading name of EUI Ltd) had applied for a Norwich Pharmacal order against Vodafone after suspecting one of its own customers had made a fraudulent insurance claim.
The insured man's home insurance policy let him claim temporary housing costs if he had to move out from his address in London while damage was repaired. His insurer thought its (unnamed) customer was fraudulently claiming rent from it after moving into a house owned by his parents, following what he said was a water leak in his own home.
What's a Norwich Pharmacal order?
"If through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrongdoing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers," said Lord Reid, the judge who created NPOs in the 1970s.
NPOs are mainly used for legal disclosure of documents owned by third parties when someone is suing somebody else in the civil courts.
Lord Justice Baker said Admiral believed "that there may be grounds for a claim against the policy holder and his mother in deceit and conspiracy. For that reason, before taking proceedings, they wish to obtain information which may clarify whether or not the policy holder's parents were staying in Milton Keynes between 2 and 8 December 2019 as asserted by the policy holder in his signed statement."
[5]Assange extradition case goes to UK Home Secretary as High Court rules he can be sent to US for trial
[6]Uber's gig economy business model takes a blow from London legal double-whammy
[7]UK Home Secretary delays Autonomy founder extradition decision to mid-December
[8]Google swats away £3bn Safari Workaround ad-tracking cookie lawsuit in Supreme Court victory
That information was the insured man's mother's "call records" and "the cell site data showing the location of the phone during the period in question," as the Court of Appeal said.
Admiral also wanted copies of "SMS/MMS data." His Honour Judge Sephton QC, sitting as a High Court judge in Manchester, refused Admiral's legal application last year – even though Vodafone had "indicated it did not oppose the application."
[9]
Throwing out Admiral's uncontested appeal case (Vodafone didn't turn up, telling the court it remained "neutral"), Lord Justice Baker said:
The fact that the phone account holder would have been able to pretend she was somewhere she was not does not draw the phone company into her wrongdoing. It is true that the phone records may assist in establishing the truth of the parents' whereabouts. But in that regard the phone company is manifestly a mere witness.
Its position is no different from anyone else who may be able to provide evidence about that issue – for example, the nephew living in Milton Keynes, or the neighbours to the parents' property, or, as Lewis LJ helpfully suggested in the course of the hearing, the milkman.
Norwich Pharmacal orders can only be granted if the respondent was somehow involved in the alleged wrongdoing. Merely being a witness (such as a CCTV operator) doesn't cross that threshold.
Tech lawyer Neil Brown of decoded.legal, who spotted the court decision and [10]blogged about it, mused that the precedent this case sets "gives ISPs and communications providers a reasonable degree of scope for arguing that, while they might have information, they're not just a reference source, available on demand, and that they must be more closely connected with the underlying issue to justify the grant of an order."
And in Germany
Swiss DNS provider Quad9 lost a legal bid last week to suspend an order forcing it to block DNS lookups for IP addresses of sites Sony Music claimed were hosting pirated albums.
Quad9 presents itself as a security-enhancing non-profit; the company merely runs a DNS server and blocks lookups to addresses on its internal blacklist.
Sony secured the injunction from a Hamburg court in the summer after convincing a judge that resolving domain names for sites allegedly hosting copyright-infringing files was in breach of German law.
A statement from a German civil rights campaign group (complete with video from ex-Pirate Party MEP [11]Julia Reda ) [12]reckoned that Quad9 didn't qualify for legal immunity given to ISPs in Germany "because it does not itself route the copyright-infringing information from A to B, but merely provides indirect access to it."
[13]
John Todd, general manager of Quad9, said in a statement: "There are a large number of internet-based services which we think ultimately are put at serious risk by this ruling, and we will not stop our legal challenges on this injunction." ®
Get our [14]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YbzCQZ8xihLM4XBf8AgTfgAAANE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.bailii.org/ew/cases/EWCA/Civ/2021/1771.html
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbzCQZ8xihLM4XBf8AgTfgAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YbzCQZ8xihLM4XBf8AgTfgAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/12/10/assange_extradition_confirmed_high_court/
[6] https://www.theregister.com/2021/12/06/uber_free_now_court_appeal_double_whammy/
[7] https://www.theregister.com/2021/11/29/autonomy_lynch_extradition_delayed/
[8] https://www.theregister.com/2021/11/10/lloyd_v_google_judgment_supreme_court/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbzCQZ8xihLM4XBf8AgTfgAAANE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://decoded.legal/blog/2021/12/the-limits-of-norwich-pharmacal-orders-when-a-cellular-operator-is-a-witness-not-a-facilitator-of-wrongdoing
[11] https://www.theregister.com/2019/02/08/google_warns_eu_copyright/
[12] https://freiheitsrechte.org/quad9-Eng/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YbzCQZ8xihLM4XBf8AgTfgAAANE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
It depends on which country you're in, but where I am I would sue the bejeezus out of them if they gave up that information without a full Court order.
In my opinion, that sort of data should only be accessible after an order from the Court, and that in turn should be the result of a police request, not because some private entity has some suspicions. This is not because I expect the police to have higher standards (let's just say that that varies between countries and even counties), but because this is the correct, well established legal pathway that ensures that not every Tom, Dick and Harry can just gain access to such information.
But, the article says that Admiral were applying for a court order to get the details from Vodafone. So doesn't that mean that Vodafone REFUSED "to give up someone's call details to a random barrister without a court order"???
Reading is not a prerequisite for outrage.
Vodafone weren't objecting to the legal process, and this shows why they didn't need to. Our courts are still vaguely sane.
That's the way I read. Vodafone would supply what the court ordered. Also that Admiral's request may have been too broad. If it was to establish location, the request location. Wanting message contents, or even CDRs seems like fishing.
I'm still puzzled that a private entity can go to Court for this data.
That should really only be available as part of a police or government investigation, not as some data any private entity can request for a vaguely plausible reason and (I note) without any reference to the rights of the third party the data is requested from, nor with any input from them so that they have the opportunity to object and possibly request sanctions for even trying.
No, no, NO.
Investigations would get a lot harder if the investigation target knew, and could object.
But I kind of agree. The update to RIPA reduced a lot of entities that had previously used & abused surveillance powers. System isn't perfect, and it's a delicate balancing act between the need to detect and prevent crimes, and a right to privacy. Having a court weigh up whether a request is reasonable, proportionate or just legal, helps.
To me, the biggest problem is on the commercial side. Can't get a court order? Get an account with one of the many data slurpers & aggregators that claim to provide location services and more. Don't even need to provide your credit card details because a good one would know yours already. And they're far less regulated.
I am kind of curious though. I generally think of fraud as a criminal matter, so how the split works between criminal and civil fraud cases. But insurance fraud isn't a victimless crime, so insurers need ways to discourage it.
Wanting to establish that they stopped calling their mum three times a week however, possibly indicates that they were communicating in some other way (like on the sofa).
If they allowed for "half market rate" rental if you had family to stay with then we'd all be better off...
There's a difference between staying with family, and renting family's rental property.
If you're suggesting paying half market rates to those who stay with family for nothing, then I still disagree - it should be full market rates for a reasonable alternative if your accommodation is uninhabitable (and insured, natch), whether you spend the money on that, or choose to blow it on crack and hookers and spend the nights under a bridge.
spend the nights under a bridge
I agree if your accommodation is uninhabitable, you should get the rent back. No doubt the insurance company has a different view, but having a different view than the insurance company is not fraud.
Fraud would be that your accommodation is habitable, you can't get out of the lease, so you move back in with your folks and claim the rent on insurance. Other variations on that scenario are possible.
Glad to see this one shot down in court, though. The insurance company is also being a bit "fraudulent" about the basis for requesting the data.
...but where would it stop if granted?
And if they found no records on the mobile, would they then want to check Skype on a laptop or any other digital device?
Look toi see if a VPN was activated to make it look like they were somewhere else?
Hmmm...
If they were claiming a water leak and saying they couldnt stay there because of it, well I can think of a few steps to take before checking phone records.
Talking to the Plumber who stopped the leak, about how much damage there was, and whether someone could still live there (and only the dodgies of dodgy plumber is going to lie to the insurance companies and risk finding themselves blacklisted).
Sending someone around to see if the flat was occupied.
Talking to the neighbours.
List seems pretty long and easy (and cheap) compared to paying for some lawyers to get a court order to get some, maybe useful-maybe not, phone data.
Re: Hmmm...
Right, but I think they are trying to investigate the whereabouts of the parents over long and continuous stretches of time. Might be easy to find a witness who said they saw them, but that doesn't help. Paul Drake could have found the witness who saw everything and established the time line.
I can't say I am impressed with Vodaphone's willingness to give up someone'a call details to a random barrister without a court order.
Having been a customer, I have always had the feeling that customers are not at the top of their priority list.