Generate Group Pty Ltd v Sea-Tech Automation Pty Ltd

1. The second respondent's interlocutory application dated 21 December 2016 be dismissed.
2. The second respondent pay the applicant's costs of the interlocutory application, as agreed or taxed.
3. Order 7 made on 30 November 2016 be vacated.
4. The parties confer and file agreed or competing proposed orders for the resolution of their outstanding interlocutory application within seven days.
5. Any application to stay orders 3 and 4 above be made in the first instance to Justice Jagot. Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

JAGOT J: 1 The present issue in this matter is whether the first respondent, Sea-Tech Automation Pty Ltd, in producing items in response to a notice to produce served on it, acted in error and to the prejudice of the second respondent, Greg Harris, who wishes to claim the privilege against self-incrimination in respect of items produced. 2 I have decided that there was no error, Sea-Tech properly produced the items which were under its control, and Mr Harris cannot call in aid the privilege against self-incrimination because the notice to produce was properly served on Sea-Tech. 3 The relevant facts are these. 4 On 18 December 2015 the applicant, Generate Group Pty Ltd, commenced proceedings against Sea-Tech alleging that Sea-Tech had infringed Generate's copyright in a computer software product known as Generate V6. Both Sea-Tech and Generate have been legally represented at all times. 5 By June 2016 Generate believed that its computer records relating to the proceedings had been hacked, and suspected that Sea-Tech was responsible. It obtained an interlocutory injunction on 5 July 2016. By this time Generate had discovered evidence indicating that its electronic files relating to the litigation had been remotely accessed using TeamViewer IDs not associated with Generate and that a director of Sea-Tech, Mr Harris, who is now the second respondent but was not a party at this time, was responsible for this unauthorised access. TeamViewer is a software program which enables remote access to a server. The orders associated with the injunction made on 5 July 2016 included that Sea-Tech propose a forensic expert to take and keep a secure image of devices associated with two specified TeamViewer identification numbers (IDs). 6 On 26 July 2016 Generate's lawyers served a notice to produce on Sea-Tech's lawyers. The notice required production at a case management hearing on 2 August 2016 of "the device which has at any time had TeamViewer installed on it with the TeamViewer ID 774 ### ###". 7 On 28 July 2016 Generate's lawyers wrote to Sea-Tech's lawyers advising that Generate was contemplating seeking relief, including that if Sea-Tech's lawyers had been instructed by Mr Harris on behalf of Sea-Tech those lawyers and counsel instructed by them must cease to act for Sea-Tech. 8 The lawyers for Sea-Tech did not then cease to act. By an email dated 2 August 2016, immediately before the case management hearing, Sea-Tech's lawyers wrote to Generate's Lawyers saying they were instructed that documents would be produced in answer to the notice to produce "including a computer". The email continued: We have been informed that the computer includes personal and confidential information of Mr Harris and his family as well as privileged and confidential material of the Respondent. … For this reason, we have included proposed order 2. In relation to the computer, we also learnt yesterday that Mr S Graiche of Secom Technology (Secom) made a forensic image of the computer on 29 July 2016. This image was provided to us yesterday. The Respondent proposes to also produce that forensic image in answer to the Notice to Produce. 9 On 2 August 2016, I made orders by consent between Generate and Sea-Tech which required compliance with the notice to produce by 4.00pm on 3 August 2016 and also made order 2 to the effect that neither party be granted access to any documents produced until further order. 10 On 3 August 2016 Sea-Tech produced to the Court and, possibly, a USB device, a computer in answer to the notice to produce. I say "possibly" a USB device because it is unclear whether this device was also produced on 3 August 2016 or produced only after a further order I made on 9 September 2016. Either way, Sea-Tech was legally represented at the time both devices were produced to the Court. 11 Sea-Tech changed its lawyers on 31 August 2016. 12 On 9 September 2016 I made orders by consent between Sea-Tech and Generate requiring production of further things (a copy of a source code and a USB device) and made orders for access in favour of both parties subject to an agreed regime permitting inspection and copying of the things produced by an independent expert only, subject to undertakings by that expert being provided. 13 When Generate's lawyers sought access at the Registry to the things produced under the notice to produce, they were given access only to the USB device, not to the computer. Due to some confusion, it was not apparent to Generate that Sea-Tech had produced to the Court not only the USB device containing an image of a computer hard drive, but also the computer referred to in the email from Sea-Tech's lawyers of 2 August 2016. Access to the USB device was provided by the Registry on the basis of an undertaking by Generate's lawyers which complied with the regime established in the consent orders dated 9 September 2016. 14 On 9 November 2016 I made an order joining Mr Harris as the second respondent to the proceedings. 15 By 30 November 2016 it became apparent that the computer which Generate believed had not been produced to the Court as required had, in fact, been produced and the computer was located in the Registry. I stayed the order for access made by consent on 9 September 2016 and ordered the parties to attend mediation, concerned by the fact that the proceedings had become bogged down in satellite disputes capable of sending all parties into liquidation or bankruptcy given the potential expense involved. 16 On 21 December 2016 Mr Harris filed an interlocutory application seeking, amongst other things, to set aside the notice to produce. 17 By 6 February 2017 it was apparent that the mediation had not succeeded. 18 On 10 February 2017, by consent, I made orders for Mr Harris's application and Generate's "application for access to the computer" to be heard on 24 March 2017. In respect of the latter part of the order, I had already made orders by consent for access to all things produced on 9 September 2016, which I stayed on 30 November 2016. Accordingly, the application of Generate is better understood as an application for the stay on access to be lifted. 19 Mr Harris contends that the notice to produce should be set aside and the computer and USB device (as well as copies of the image on the USB device) returned to him because he asserts the items were not in Sea-Tech's control when produced but his control, and he has and is entitled to the privilege against self-incrimination. It is not in dispute that if Mr Harris accessed Generate's server and copied files held thereon relating to this proceeding he is exposed to a risk of prosecution under s 308H of the Crimes Act 1900 (NSW) and s 478.1 of Sch 1 of the Criminal Code Act 1995 (Cth). Both provisions create offences for unauthorised access to restricted data held in a computer. 20 The nature of the privilege against self-incrimination is also not in dispute. It is a substantive right which operates so that no person may be compelled to do any thing which may tend to bring that person into peril of criminal conviction (Reid v Howard (1995) 184 CLR 1 at 11-12). Nor is the fact that the privilege may be asserted to prevent production of a computer in doubt (Hepburn v Teplitzky [2010] FCA 801). The issue in the present case is that the notice to produce was issued to Sea-Tech, a corporation which cannot claim the privilege (Environment Protection Authority v Caltex Refining Co Pty Ltd (1993) 178 CLR 477) and was produced without objection by Sea-Tech at a time when it was legally represented and Mr Harris was not a party to the proceeding. 21 Generate's contentions are straightforward. The notice to produce was served on Sea-Tech. Sea-Tech produced the USB device and computer in answer. From these facts alone it must be inferred that the USB device and computer were in the control of Sea-Teach and thus liable to be produced by it under r 30.28 of the Federal Court Rules 2011 (Cth) which provides that a party may serve a notice to produce "requiring the party served to produce any document or thing in the party's control". Sea-Tech could not and did not claim the privilege against self-incrimination. It also could not claim that privilege on behalf of any person, including Mr Harris (Rochfort v Trade Practices Commission (1982) 153 CLR 134 and R v Ronen [2004] NSWCCA 67; (2004) 62 NSWLR 707). Mr Harris cannot assert the privilege because, by its nature, it is confined to relieving him of doing any act which might tend to incriminate him. The answer of the notice to produce by Sea-Tech did not (and does not) involve any such act by Mr Harris. The stay on the access order should be lifted. 22 Mr Harris's contentions are more complex. He contends that: (1) He, not Sea-Tech, owns the computer in question. (2) He is a director of Sea-Tech but was not a party to the proceedings when the USB device and computer were produced or the orders for access made. (3) It should be inferred that he did not have legal advice at those times. Had he had legal advice he would have asserted the privilege and did so once he was separately represented. (4) The sequence of events shows that the lawyers for Sea-Tech were under pressure of time to arrange production and they reserved claims for privilege in the correspondence and orders of 2 August 2016. (5) It should be inferred that the then lawyers for Sea-Tech made a mistake in producing the USB device and computer as the devices were not in Sea-Tech's control. The mistake is apparent because on 28 July 2016 the then lawyers for Sea-Tech were told by Generate's lawyers that they could not continue to act if they had taken instructions from Mr Harris but continued to act at the time the devices were produced and orders for access made. Sea-Tech's lawyers ought to have ceased acting immediately. (6) While the USB device and computer may be inferred to have been in Sea-Tech's possession at the time they were produced, they should not be inferred to have been under Sea-Tech's control. Mere production may but does not necessarily imply control (Rochfort at 140). Control by Sea-Tech would not be inferred given (1) to (5) above. (7) The mistake by Sea-Tech in producing devices not under its control has deprived Mr Harris of asserting the privilege because, but for production by Sea-Tech, Generate would have had to serve a subpoena on him for the computer to be produced. (8) A subpoena should have been served on Mr Harris as the owner of the devices in question and the person with control of them in which event he would have asserted the privilege (Rochfort at 144-145). (9) It would be unjust for Mr Harris to be deprived of his rights because Sea-Tech made a mistake on 3 August 2016 in producing the devices, compounded on 9 September 2016 when it consented to access orders. It is also plain that Mr Harris has not waived his right to assert the privilege (Eizenberg v Eizenberg [2008] VSC 322 at [29]-[34]). 23 Mr Harris also contends, based on Rochfort at 144-145, that irrespective of the matters above there are strong discretionary reasons why the devices ought not to have been produced by Sea-Tech when they are Mr Harris's devices, not those of Sea-Tech. 24 No doubt if Generate had served a subpoena on Mr Harris requiring production of the computer Mr Harris could have claimed the privilege against self-incrimination and would not have had to produce the computer. Of course, this is not what occurred. 25 Ownership of the computer is in dispute. On the evidence, I am satisfied that I should proceed on the basis that Mr Harris, not Sea-Tech, owns the computer. The fact that the invoice is addressed to Sea-Tech does not outweigh the other evidence that indicates that Mr Harris paid for the computer and Sea-Tech did not. Lack of evidence about possible reimbursement of Mr Harris by Sea-Tech is in the realm of speculation. Ownership is not dispositive, however, because the obligation of production under r 30.28 of the Federal Court Rules depends on control, not ownership. 26 From the evidence adduced in support of his application, it is apparent Mr Harris used the computer which was located in his home for work (that is, Sea-Tech's) purposes. As noted, Mr Harris is a director of Sea-Tech and, it is clear from the evidence, carries out work for Sea-Tech, albeit the contractual arrangements into which he and Sea-Tech have entered for that purpose are not known. It is also apparent that the computer was used by Mr Harris and his family for other private purposes. 27 There are a number of reasons why I am satisfied that, despite Mr Harris owning the computer, Sea-Tech had control of the computer and the USB device (which was created on 28 July 2016) at all material times. The consequence is that Sea-Tech was required to produce the devices and Mr Harris was (and is) not able to claim the privilege against self-incrimination to prevent either production (which has already occurred) or access. 28 First, "control" is an ordinary English word which takes its ordinary meaning in r 30.28 of the Federal Court Rules. The Oxford English Dictionary Online defines "control" in item 2 as "[t]he fact or power of directing and regulating the actions of people or things; direction, management; command". The Macquarie Dictionary Online defines "control" in item 1 as "to exercise restraint or direction over; dominate; command". These are the senses in which "control" is used in r 30.28 of the Federal Court Rules. In Johnston Fear & Kingham v Commonwealth (1943) 67 CLR 314 at 324 Rich J said that "the word "control" is wide enough to include many types of possession which are not commensurate with full ownership". Accordingly, the fact that I consider Mr Harris owns the computer is not determinative. 29 Second, I am not satisfied that Mr Harris owns the USB device. The USB device, I infer, was brought into existence by Sea-Tech for the purpose of these proceedings and in anticipation of Sea-Tech complying with order 2 made on 5 July 2016. Further, the order I made by consent on 9 September 2016 included order 1b which required Sea-Tech to cause its former solicitor to deliver up to the Court "the USB device provided by the Respondent to Minter Ellison on 1 August 2016…". This discloses that it is Sea-Tech which provided the USB device to the solicitor for the purpose of production to the Court in response to the notice to produce. 30 Third, and as noted, Sea-Tech had legal representation at all material times. Given this, it must be inferred that Sea-Tech had the benefit of legal advice about its obligations under the notice to produce. The fact of production by Sea-Tech is itself evidence that the former lawyers and the person from whom it was obtaining instructions for Sea-Tech, which I infer to have been Mr Harris, believed that the computer and the USB device were in Sea-Tech's control. Further, it must not be overlooked that Sea-Tech's new lawyers consented to the orders for access despite knowing that the computer contained information which was private to Mr Harris's family. This is the reason for the agreed regime for access. In other words, it seems to me that two separate legal representatives must have taken the view that the notice to produce to Sea-Tech required Sea-Tech to produce the computer and USB device. That conclusion can have been reached only on the basis of information from Sea-Tech, via Mr Harris, that both devices were under the control of Sea-Tech. 31 Fourth, the submission that Sea-Tech's former lawyers made an error when they ceased to act for Sea-Tech on 28 July 2016 is without merit. The former lawyers were entitled to consider their position and to continue to act for Sea-Tech while they did so. The assertion of a conflict of interest by Generate's lawyers did not impose an obligation on Sea-Tech's former lawyers to cease acting immediately. 32 Fifth, none of Sea-Tech's lawyers have given evidence to the effect that they made an error or had engaged in any oversight when entering into the various orders by consent requiring production of and permitting access to the devices. Nor, of course, has Mr Harris given evidence that would suggest that the devices were not in Sea-Tech's control at the relevant times. 33 Sixth, there is an objective factual basis which would support the inference that Sea-Tech's lawyers considered that the devices were in Sea-Tech's control and were right to do so. Despite my conclusion that Mr Harris owns the computer, Mr Harris is an officer of Sea-Tech. He ordered the computer in the name of Sea-Tech. He used the computer at home for Sea-Tech's purposes. Sea-Tech must be taken to have agreed to this use. An inferential concomitant of this is that Sea-Tech must have had rights to access all data on the computer which belonged to it and, to do so, necessarily must have had the right to access the computer itself. Thus, control of the computer, at least insofar as it contains any information of or connected to Sea-Tech, was vested in Sea-Tech. Moreover, there is evidence indicating that the computer was used to access Generate's litigation files at a time when Sea-Tech alone was the respondent. If Mr Harris accessed Generate's litigation files then it is not the case that such unlawful action necessarily would be beyond the scope of any authority he might have had from Sea-Tech. Nor is it the case that illegality necessarily means that Sea-Tech itself cannot be liable or is not responsible in law for the illegality (Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2016] FCAFC 78 at [48]-[74]). 34 Seventh, if it be the fact (as I infer) that Mr Harris was responsible for obtaining the USB device and providing both devices to the solicitors for Sea-Tech, it was not necessary that he do so by reason of the service of the notice to produce on Sea-Tech. Sea-Tech, it is apparent, has another director who gave evidence in support of Mr Harris's application. This director, Mr Griffiths, described he and Mr Harris as the co-founders and directors of Sea-Tech. As in Ronen, the notice to produce in the present case did not require Mr Harris, the owner of the privilege, to do anything. If Mr Harris has chosen to do things in response to the notice to produce, that is not a reason for setting aside the notice. It may be, to that extent, Mr Harris waived the privilege, but the issue in the present case is not waiver, as Generate acknowledge. 35 Eighth, the observations in Rochfort at 144-145 do not suggest that in a case such as the present, where a principal of a company uses a computer for work purposes, it is improper for a subpoena or notice to produce to be served on the company for production of the computer rather than on the principal. The fact that, if a subpoena had been served on Mr Harris he would have been able to assert the privilege so that he did not have to do anything (such as produce the computer) which might tend to incriminate him, does not mean that the notice to produce was inappropriately served on Sea-Tech. The analogy with Rochfort does not exist because we know Mr Harris used his computer for Sea-Tech's purposes (his wife gives this evidence). It is Sea-Tech which has the interest in this data. Even if Mr Harris personally possessed the computer, he used it for Sea-Tech's purposes. If there is any analogy to the reasoning in Rochfort at 145, the result is that it was appropriate for Generate to serve the notice to produce on Sea-Tech rather than a subpoena on Mr Harris. 36 Ninth, the fact that the computer also contains private information of Mr Harris and his family does not change the fact that Sea-Tech had control of the devices when they were produced. As noted, there is a regime in place under the orders of 9 September 2016 to protect that private information from unnecessary disclosure. If that regime is inadequate, it can be adjusted as required. 37 For these reasons, I am not persuaded that the process of the production of the devices and the making of orders for access to them has miscarried in any way. Sea-Tech had control of the devices and was thus obliged to produce them. It did so and access orders, mindful of the private information which was also held on the devices, were made. The notice to produce to Sea-Tech did not require Mr Harris to do anything that might incriminate himself. He was not entitled to assert the privilege in respect of Sea-Tech complying with its obligations and Sea-Tech was not entitled to assert the privilege on Mr Harris's behalf. Nothing in the events which have happened suggests any mistake or oversight of any kind by Sea-Tech's former lawyers when the orders of 5 July 2016 and 2 August 2016 were made or, indeed, by its current lawyers when the orders of 9 September 2016 were made. I am unable to discern any relevant fact which would justify an exercise of discretion not to permit access to the computer in circumstances where the computer was produced without objection by Sea-Tech, in circumstances which indicate that Sea-Tech had control of the computer (and the USB device), and where the law is that Sea-Tech could not assert any privilege on behalf of Mr Harris against self-incrimination. 38 The only other observation which is required is that Sea-Tech itself sought to make submissions to have the notice to produce set aside or access prevented on the grounds that the notice to produce involved an abuse of process in that it had no legitimate forensic purpose and was a fishing expedition. The problem with this is that Sea-Tech complied with the notice to produce without objection and consented to orders for access. If Sea-Tech wished to object to the notice to produce or challenge its validity, it should have done so before production or, at the least, before access orders were made and access to the USB device in fact obtained by the independent expert. In any event, there was a legitimate forensic purpose for the notice to produce. Generate's claim is that the judicial process has been undermined by the unauthorised access to its litigation files which ought to have consequences for Sea-Tech in these proceedings. This is not a collateral purpose. Generate is not fishing for a new claim. It is asserting that its existing claim has been compromised. 39 While I accept that I have an overriding discretion which would enable me to vacate all of my previous orders, I cannot see any basis to do so given the matters set out above. In the case of Mr Harris, the interlocutory application appears to be an attempt to take an objection to production by Sea-Tech, after the event, and in circumstances where Mr Harris would not have been able to assert any privilege against self-incrimination in response to a notice to produce addressed to and answerable by Sea-Tech. In the case of Sea-Tech, its submissions appear to be a belated attempt to challenge the validity of the notice to produce in circumstances where it has already answered the notice and consented to orders for access when, at all times, it had the benefit of legal advice. I can see no reason to exercise any discretion in favour of Mr Harris or Sea-Tech in these circumstances. 40 Mr Harris's application should be dismissed with costs, and consequential orders made. I certify that the preceding forty (40) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Jagot .