Qudos Mutual Limited v Infosys Limited [2019] FCA 702 | Case summary

Federal Court of Australia|2019-05-20|Before: Burley J

THE COURT ORDERS THAT:

The Prospective Applicant is to file and serve any submissions in relation to the costs of the application and the time required for compliance with the form of order set out in [5] of the reasons within 7 days of the delivery of these reasons.
The First Prospective Respondent is to file and serve any submissions in response within 7 days thereafter.
The Prospective Applicant is to file and serve any reply submission of no longer than 2 pages within 7 days thereafter.
If no submissions are made in accordance with (1) and (2), the orders for discovery will be finalised on the papers. Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT 1 INTRODUCTION [1] 2 THE EVIDENCE [8] 3 FACTUAL BACKGROUND [14] 4 CONSIDERATION [34] 4.1 The dispute [34] 4.2 Is there an insufficiency of information? [38] 4.3 Qudos categories are overbroad and unclear [52] 4.4 Discretionary factors [56] 5 DISPOSITION [61]

INTRODUCTION 1 Qudos Mutual Limited trades as Qudos Bank. Prior to April 2016 it traded under the name Qantas Credit Union. In March 2015 Qudos entered into a Master Banking Services Agreement with Infosys Limited pursuant to which Infosys agreed to provide a range of services relevant to a major overhaul of the Qudos digital banking arrangements. With the assistance of Infosys, Qudos planned to build a new, fully integrated banking platform, including core banking, customer relationship management, online banking, mobile application and other systems. The relationship between Qudos and Infosys broke down, and in October 2018 Qudos issued a notice of termination of their agreement. One of several areas of dispute between the parties by this time was an allegation made by Qudos that Infosys may, by producing some software for the Australian Military Bank Limited (AMB), have acted in breach of confidence, breached of certain terms of the Master Banking Services Agreement concerning the obligation of confidence, and also infringed the copyright that it owned in some computer software and related materials. 2 Qudos is considering commencing proceedings for relief in respect of each of these causes of action, but contends that it does not have sufficient information to decide whether to do so. In November 2018 it filed an Originating Application seeking Orders pursuant to rule 7.23 of the Federal Court Rules 2011 (Cth) (FCR) for the production of documents from Infosys and from a related company, Infosys Technologies Australia Pty Ltd. In January and February 2019 Infosys voluntarily provided some documents in accordance with agreed orders made on 20 December 2018. Qudos is not satisfied that the documents produced enable it to decide whether to start a proceeding, and in April 2019 it filed an Amended Originating Application seeking production of documents additional to those produced. 3 FCR rule 7.23 provides: (1) A prospective applicant may apply to the Court for an order under subrule (2) if the prospective applicant: (a) reasonably believes that the prospective applicant may have the right to obtain relief in the Court from a prospective respondent whose description has been ascertained; and (b) after making reasonable inquiries, does not have sufficient information to decide whether to start a proceeding in the Court to obtain that relief; and (c) reasonably believes that: (i) the prospective respondent has or is likely to have or has had or is likely to have had in the prospective respondent's control documents directly relevant to the question whether the prospective applicant has a right to obtain the relief; and (ii) inspection of the documents by the prospective applicant would assist in making the decision. (2) If the Court is satisfied about matters mentioned in subrule (1), the Court may order the prospective respondent to give discovery to the prospective applicant of the documents of the kind mentioned in subparagraph (1)(c)(i). 4 Infosys opposes the making of any orders under FCR r 7.23. It contends that the documents that it has produced should be enough for Qudos to make a decision whether or not to bring the proceedings. Infosys does not dispute for present purposes that Qudos reasonably believes that the prospective applicant may have the right to obtain relief in the Court within FCR r 7.23(1)(a), but it disputes, in the light of the documents that it has supplied, that Qudos does not have sufficient information to decide whether to start a proceeding to obtain relief within FCR r 7.23(1)(b). It also objects to the scope and form of the categories of documents sought by Qudos, and contends that production in accordance with those categories would be oppressive and argues that there are additional discretionary reasons why orders should not be made. In addition, Infosys contends that there is no basis upon which an order should be made against Infosys Technologies. 5 For the reasons set out below, I consider that Qudos is entitled to orders for the production of documents, but that the scope and form of the categories proposed by Qudos is too broad and prolix. During the course of argument I suggested a broad form of orders to confine production to the matters directly relevant to the question of whether Qudos had a right to obtain the relief sought. I asked the parties to suggest wording to put that form into effect. They were unable to agree on the precise language, but came fairly close. I have determined that the appropriate order is for Infosys to give production of the following documents: (1) A copy of: (a) the source code of the user acceptance testing website (the Qudos UAT site) hosted by Infosys Limited on the NextDC data centre (or any equivalent data centre) which contained a copy of the online and mobile banking platform developed by Infosys for Qudos pursuant to the Master Banking Services Agreement dated 25 March 2015, as at 19 February 2018; and (b) the source code of the user experience and user interface of the mobile and online banking solution that Infosys Limited developed for Australian Military Bank Limited (the AMB UX code) as at 19 February 2018, including the revision history thereof up to that date. (2) Documents recording the development and preparation by Infosys of the source code identified in (1)(b) up to 19 February 2018, including minutes of meetings and correspondence between Infosys Limited and Australian Military Bank Limited related to its development and preparation. 6 Qudos did not advance any substantive submission to justify the joinder of Infosys Technology to the proceedings and I dismiss the application against that party. 7 The question of costs of the application is unresolved. In addition, the parties have not had an opportunity to make submissions as to the time required to produce documents in accordance with the orders in [5] above. Accordingly, I direct that Qudos file any submissions going to the costs of the application and the time for compliance, limited to no more than 4 pages in length, within 7 days. I direct that Infosys respond within 7 days with submissions of no more than 4 pages in length, and Qudos reply with submissions of no longer than 2 pages within 7 days thereafter. Unless either party requests otherwise, I will determine the balance of the application on the papers.

THE EVIDENCE 8 Qudos read the evidence of 4 witnesses. Rodney David McKemmish is the director and principal of Cyter Pty Ltd, a forensic consultancy firm. In this capacity, he provides forensic technology and cyber forensic consultancy services in a range of technology matters. He has over 20 years' experience in both law enforcement and the private sector specialising in computer forensics. In October 2018, he conducted an examination of certain materials about which he gives evidence in his first affidavit sworn on 31 October 2018. In his second affidavit, sworn on 26 February 2019, he gives further forensic evidence based on source code produced by Infosys. In his third affidavit, sworn on 16 April 2019, he replies to the evidence of Darren Michael Andrew, Infosys' expert witness. 9 Cindy Lea Hansen is the general counsel and company secretary of Qudos. She has been practising law for over 25 years and has held her current position since 2007. Ms Hansen gives evidence as the relevant decision maker within Qudos who must determine whether or not to commence proceedings. In her first affidavit, affirmed on 5 November 2018, she gives evidence about the contractual relationship between Qudos and Infosys, and the work undertaken by Infosys for Qudos. She gives evidence of Qudos' concerns that Infosys may have used Qudos' intellectual property and confidential information in developing software for AMB, and provides a history of the correspondence prior to the commencement of proceedings between Qudos, Infosys, and AMB. In her second affidavit, affirmed on 27 February 2019, Ms Hansen gives evidence of the documents produced by Infosys to Qudos during the current proceedings, and as to the further information she believes is necessary to ascertain whether Qudos may have a right to relief against Infosys. In her third affidavit, affirmed on 18 April 2019, Ms Hansen replies to the evidence of Rachael Zavodnyik. 10 Christopher Alfred Rodrigues is employed in the role of Manager of Application and Digital Services at Qudos, where he is responsible for providing support, administration, and management for all business and banking applications for staff and customers. In an affidavit affirmed on 2 November 2018, he gives evidence about the business relationship between Infosys and Qudos, about the online banking platform developed by Infosys for Qudos, and about Qudos' engagement with HeathWallace, an independent firm that was engaged to assist Qudos. He also gives evidence of the alleged similarities between the software developed by Infosys for Qudos and AMB respectively. 11 Steven George Ashby is the Head of Designs and Operations at HeathWallace. In an affidavit sworn on 1 November 2018, he gives evidence about the work HeathWallace performed for Qudos and the interaction between HeathWallace and Infosys in the creation and delivery of the solution developed for Qudos. He also gives evidence about a comparison that he made between the user experience of the AMB internet banking solution and the Qudos equivalent. 12 Infosys read the evidence of two witnesses. Darren Andrew Michael is a forensic technology practitioner with over 25 years' experience, and is employed as the Chief Information Officer at Patersons Securities Ltd. In his affidavit, affirmed on 10 April 2019, he gives technical evidence in response to Mr McKemmish's evidence. 13 Rachael Eve Sarah Zavodnyik is the Assistant General Counsel and Head of Legal for the Asia-Pacific Region at Infosys. She has been a practicing solicitor for over 23 years and has worked in various positions at Infosys since 2014, taking her current position in January 2019. In her affidavit affirmed on 10 April 2019, Ms Zavodnyik gives evidence about the Finacle product that Infosys and its related company EdgeVerve Systems Ltd provides to customers, which comprises a suite of software that can be tailored to the needs of clients seeking an online banking system. She also gives evidence about the Qudos and AMB projects and evidence in answer to the current application, specifically addressing the categories of documents sought by Qudos in its Amended Originating Application. Ms Zavodnyik gives evidence that Infosys Technologies has not provided software development services, engaged in any operations, or had any employees since 1 April 2012.

FACTUAL BACKGROUND 14 Having regard to the nature of the present application it is not appropriate to make formal findings of fact. For present purposes it is sufficient to note that the following matters emerge from the evidence relied upon in this application. 15 In 2012 Qudos commenced a major digital transformation project, one aspect of which was to develop an integrated banking platform. In February 2015 Infosys was selected as the technology supplier for this project. in March 2015 the parties entered into the Master Banking Services Agreement, which set out the terms on which Infosys was engaged to develop and implement the project, in March 2015. Later, a third party contractor, HeathWallace Australia Pty Ltd was engaged by Qudos to undertake the design of the user experience and user interface (UX/UI) for the new platform. In March 2016, HeathWallace commenced design work in collaboration with Qudos. It undertook research into the requirements of Qudos and supplied its findings in a set of design principles that it then applied to design the UX/UI and the development of the software code to produce it. It then prepared the final "deliverables" in the form of UX prototypes, high fidelity visual design "assets" for interfaces, and front end software code (the Qudos UX code) for the UX/UI which consisted of HTML, CSS and JavaScript code. 16 In preparing these materials HeathWallace collaborated with Qudos and Infosys using various software tools that enabled Qudos and Infosys to have access to the work under development. Infosys had access to the front end Qudos UX code on the test site, because it was responsible for the back end build and integration with the front end code. In order to create the back end, and to ensure it was interactive with the front end code, Infosys took the Qudos UX code created by HeathWallace and put it into its framework. According to Mr Rodrigues, Infosys worked on the code and stored it on a server in Melbourne. He says that one of the obligations of Infosys was to "stitch" the HTML pages of the UX/UI developed by HeathWallace in order to create a user flow. "Stitching" enables individual HTML pages to interact with one another to create a functional front end for users. This work was completed and delivered to Qudos as a "stitched website" (the stitched site). 17 In the course of working on the project, HeathWallace delivered various design documents, visual design assets, UX prototypes and the source code for the UX/UI. Qudos contends that each of these are literary works, artistic works and computer programs within the definitions of these terms in the Copyright Act 1968 (Cth) and that by virtue of its contractual arrangements with HeathWallace it is the owner of that copyright. Qudos also maintains that the information obtained by HeathWallace in the preparation for the development work, and the fruits of that work, concern confidential aspects of its business. 18 Qudos is concerned that Infosys has engaged in conduct that is infringes copyright in these materials, that it has acted in breach of confidence and that it has acted in breach of various contractual provisions in the Master Banking Services Agreement. I summarise the concerns expressed by Qudos below. 19 In about August 2017 Qudos became aware that Infosys had been engaged by AMB to assist in the provision of core banking, online banking and mobile banking solutions. In early February 2018 Mr Rodrigues reviewed a video posted on the AMB website which caused him to be concerned that there were many similarities between the Qudos UX/UI and the AMB UX/UI. At about the same time he learnt that an Infosys employee who was working on the Qudos project was doing work on the AMB solution while at Qudos' premises. He reported his observations to senior management within Qudos, which then instigated a series of investigations. One was a comparative review of the AMB and Qudos user interface and user experience conducted by Mr Castellaz-Faico and set out in a report dated 5 February 2018. The results led Qudos to raise the issue of potential infringement of copyright and breach of confidential information with Infosys shortly thereafter. Another was a review conducted by HeathWallace of the AMB solution after it was launched on 18 February 2018, which identified a number of design commonalities. Mr Rodrigues also conducted a comparison by using his own bank account with AMB to review the website. He observed that some of the underlying log files on the website included references to "Qudos" and "QCU" that, when coupled with the similarities observed in the user interface, appeared to Ms Hansen to provide further indication that Infosys had used the Qudos UX/UI in the AMB UX/UI. It is to be noted that none of these comparisons involved examination of the source code of the relevant AMB software. 20 Qudos raised its concerns about apparent similarities between the sites with Infosys. The parties met in February 2018. There followed a series of steps that ultimately led to the commencement of these proceedings in November 2018. In early correspondence, Infosys contended that it had developed a custom-made product for AMB using Finacle product constructs (Finacle is a suite of software for online banking systems, developed by Infosys and its related company EdgeVerve) and relying on the specific requirements of AMB as well as "publicly available information". It also contended that the Qudos solution became publicly available on the internet at the "Qudos UAT URL" (Qudos UAT site). It is apparently not controversial that this contention was not correct, because the Qudos UAT site was only accessible with the use of a confidential log in code. 21 On 27 February 2018 Qudos served a Dispute Notice which triggered the dispute resolution procedure under the Master Banking Services Agreement. This concluded unsuccessfully in April 2018, although the parties continued to attempt to resolve the dispute until June 2018. 22 The Master Banking Services Agreement did not proceed to completion. In October 2018 Qudos purported to terminate the Master Banking Services Agreement and Infosys accepted the termination, without admission of fault. The allegations of breach of contract, infringement of copyright, and breach of confidence that have been summarised above represent one aspect of the dispute. In the course of the hearing I was informed that the parties attempted to mediate the dispute in September 2018, but that mediation appears to have failed. 23 The present proceedings were served on 12 November 2018, together with the first affidavits of Mr McKemmish, Mr Ashby, Mr Rodrigues and Ms Hansen. Having regard to the contents of the affidavits, Infosys proposed consent orders, subsequently made on 20 December 2018, for the production by it of the following documents: (1) a copy of the source code underlying the AMB UX; (2) records of design meetings held by Infosys and AMB employees to design the AMB UX, and the wireframe drawings, emails and design work produced in those meetings; (3) any design brief that AMB provided to Infosys for the AMB UX; (4) documents recording the specific requirements that AMB requested for the development of the AMB UX; and (5) documents recording the design inputs and wireframe drawings that AMB provided to Infosys for the AMB UX. 24 Item (1) in this schedule of documents did not specify any particular version of the source code that Infosys was to produce, and Infosys produced the then current version of the AMB UX code. Qudos now contends that this is not the source code that it wishes to examine, for the reasons explained in Mr McKemmish's second affidavit, summarised below. 25 Ms Zavodnyik gives evidence that the content of the first affidavits of Mr McKemmish and Mr Hansen were influential in the provision by Infosys of its consent to production. 26 In his first affidavit Mr McKemmish says that in October 2018 he was provided with: (1) three stitched sites for the Qudos online banking platform that had been created and delivered by Infosys; (2) access to a test site containing the front end of the UX/UI of Qudos' online banking platform that had been delivered by Infosys; and (3) log files (automatically produced documentation of events in a computer system) obtained by Mr Rodrigues of the AMB online banking platform on 19 February 2018. 27 He notes that the log files of the AMB solution did not include any source code, and so he was not able to determine whether they contained any reproductions or adaptations of source code from the Qudos stitched sites or UX/UI. Having regard to the information that he had available to him, Mr McKemmish gives the opinion that the AMB online banking platform contains components or elements of the Qudos online banking platform and may contain reproduced or adapted source code from the Qudos UX/UI, but he could not reach a conclusion on that subject. He gives the further opinion that it he were to have access to the source code of the AMB online banking platform he may be able to determine the basis of the references to Qudos and the UAT site that he had observed in the AMB files that were produced, and compare the code with the stitched sites and Qudos UX/UI to determine whether any part of the Qudos UX/UI has been reproduced or adapted into the design of the AMB UX/UI. 28 After Infosys produced documents in accordance with the consent orders of 20 December 2018, Mr McKemmish then provided a second affidavit. In it he conducts an analysis of the AMB UX source code (AMB UX code) and compares it with the Qudos UX code and stitched sites delivered to Qudos by Infosys. He gives the opinion that the folder structures and content of the stitched sites and the Qudos UX/UI are largely the same but that the stitched site modules contain additional code, which appears to link pages and functions together. He compares the AMB UX code with the Qudos materials and concludes that they appear to share a "common heritage" having regard to the use of common folder names within similar folder structures, instances where identical code appears in both, and a number of references to Qudos related data objects/variables in the AMB UX code. However, Mr McKemmish then says that he is not able to conduct a "like for like" investigation of the two source codes. He explains that this is because the Qudos materials provided to him are in the nature of prototype code, whereas the AMB UX code is in a different form, being that of production code. 29 In order to do a proper analysis, Mr McKemmish considers that it is necessary to compare a production code version of the Qudos UX/UI and stitched sites against the AMB UX code. He states his understanding that the Qudos UX/UI and stitched sites were delivered to Infosys to develop into a functional website and mobile application which was contained on the Qudos UAT site. 30 Mr McKemmish gives the opinion that access to the source code for the Qudos UAT site would enable a comparison of the relevant codes to determine whether, and if so, to what extent, the Qudos UX code has been reproduced or adapted in the design and build of the AMB UX code. He further states that to enable the comparison to be robust, the codes should be from the same or similar time periods. He notes that Mr Rodrigues accessed the AMB file for the purpose of his comparison in February 2018. It was then that he observed similarities in the UX/UI and also the references to Qudos. He proposes that: (1) the version of the AMB UX code supplied to him be the February 2018 version; (2) that he be given access to the source code for the Qudos UAT site as at February 2018; (3) that he also be supplied with the change history showing the changes from time to time made to the AMB UX code; and (4) that he be provided with a copy of the AMB database and webserver. 31 Mr Michael responds to the McKemmish materials. He is asked four questions: (a) whether Mr McKemmish has sufficient information to determine whether the AMB UX code contains any reproduction or adaptation; (b) whether, in order to determine whether it contains any reproduction, he needs access to the 'database' or 'webserver'; (c) whether, in order to determine whether the AMB UX code contains any reproduction or adaptation, he needs a copy of Qudos UAT site or AMB UX code as at Feb 2018; and (d) whether he needs the change history. Mr Michael gives the opinion that the examples showing a common heritage supplied by Mr McKemmish are accurate and provide a reasonable basis for him to conclude that the produced AMB UX code contains reproductions or adaptations of parts of the UX code underlying the Qudos solution and written by HeathWallace (which he calls the HeathWallace UX Code) and the stitched UX code (being the UX code once it was stitched by Infosys so that the individual pages could interact with one another). His opinion is that Mr McKemmish has sufficient information to determine whether the AMB UX code contains any reproduction or adaptation and that the conclusion offered by Mr McKemmish that they have a common heritage is consistent with that conclusion. 32 Mr Michael then goes on to consider the other questions. One aspect to note in the questions posed is that Mr Michael is asked whether he needs the additional materials to determine whether the AMB UX code contains any reproduction or adaptation of the Qudos UX code or the code used for the stitched site. He does not address whether the material provided gives sufficient information as to the extent or nature of the reproduction, which would be necessary to assess infringement of copyright. 33 In her affidavit of 27 February 2019, Ms Hansen deposes that she has heightened concern about potential misuse by Infosys because it seems that AMB did have access to some Qudos materials in developing its own website and mobile application. However, it is unclear whether and to what extent Infosys used or copied or provided the Qudos materials. She lists some 16 other categories of documents that Qudos contends would assist in deciding whether to start a proceeding.

4.1 The dispute 34 Qudos seeks preliminary discovery of a detailed list categories of documents pursuant to FCR 7.23. It submits that it has reason to believe that it may have the right to obtain relief in the Court from Infosys for infringement of copyright, breach of contract and misuse of confidential information. It relies on the affidavit evidence of Ms Hansen, who has deposed to such a belief. The basis upon which orders in accordance with FCR 7.23 are sought is apparent similarities between the AMB UX and that of the Qudos UX/UI and the underlying code for each. In summary, the contention is that those similarities signify that there has been a substantial reproduction of the copyright works owned by Qudos as well as violation of the confidence reposed in Infosys by Qudos when it disclosed information concerning its business and the UX/UI developed by HeathWallace, including internal Qudos business processes, process maps and data mapping and similar materials. 35 As I have noted, Infosys does not challenge the proposition that Qudos reasonably believes that it has the right to obtain relief in respect of the alleged unauthorised use of the Qudos UX/UI when developing the AMB UX/UI. In this context, and without any admission that it has infringed copyright, misused confidential information or acted in breach of the Master Banking Services Agreement, Infosys accepts that Qudos has established the requisite belief for the purposes of FCR 7.23(1)(a). 36 I accept that this is the case. The relevant question under this part of the rule is whether the prospective applicant has a reasonable belief that it may have the right to obtain relief; Pfizer Ireland Pharmaceuticals v Samsung Bioepis AU Pty Ltd [2017] FCAFC 193 (Allsop CJ, Perram and Nicholas JJ) at [17] and [69]-[70] (Allsop CJ) and [101]-[126] (Perram J). In that case Perram J said (emphasis in original): 120 The following propositions about preliminary discovery applications should be accepted: (i) the prospective applicant must prove that it has a belief that it may (not does) have a right to relief; (ii) it must demonstrate that the belief is reasonable, either by reference to material known to the person holding the belief or by other material subsequently placed before the Court; (iii) the person deposing to the belief need not give evidence of the belief a second time to the extent that additional material is placed before the Court on the issue of the reasonableness of the belief. That belief may be inferred; (iv) the question of whether the belief is reasonable requires one to ask whether a person apprised of all of the material before the person holding the belief (or subsequently the Court) could reasonably believe that they may have a right to obtain relief; and (v) it is useful to ask whether the material inclines the mind to that proposition but very important to keep at the forefront of the inclining mind the subjunctive nature of the proposition. One may believe that a person may have a case on certain material without one's mind being in any way inclined to the notion that they do have such a case. 121 In practice, to defeat a claim for preliminary discovery it will be necessary either to show that the subjectively held belief does not exist or, if it does, that there is no reasonable basis for thinking that there may be (not is) such a case. Showing that some aspect of the material on which the belief is based is contestable, or even arguably wrong, will rarely come close to making good such a contention. Many views may be held with which one disagrees, perhaps even strongly, but this does not make such a view one which is necessarily unreasonably held. Nor will it be an answer to an application for preliminary discovery to say that the belief relied upon may involve a degree of speculation. Where the language of FCR 7.23 relates to a belief that a claim may exist, a degree of speculation is unavoidable. The question is not whether the belief involves some degree of speculation (how could it not?); it is whether the belief resulting from that speculation is a reasonable one. Debate on an application will rarely be advanced, therefore, by observing that speculation is involved. 37 However, Infosys contends that there are three substantial reasons why orders for the preliminary discovery of documents in the categories proposed by Qudos would be refused: (a) there is no insufficiency of information within FCR 7.23(1)(b); (b) the Qudos categories are overbroad and unclear; and (c) a number of discretionary factors indicate that the Court should refuse to grant the relief sought. Each of these is considered below.

4.2 Is there an insufficiency of information? 38 FCR 7.23(1)(b) requires Qudos to establish that it does not have sufficient information to decide whether to start a proceeding in the Court. 39 In Aristocrat Technologies Australia Pty Limited v Ainsworth Game Technology Limited [2018] FCA 1511, Yates J said: 43 In this connection, a prospective applicant must demonstrate as an objective fact that it lacks sufficient information to decide whether to start a proceeding. The purpose of preliminary discovery is not to require the production of material that strengthens or enhances a decision to commence a proceeding, where that decision can reasonably be made on already existing material: Matrix Film Investment One Pty Limited v Alameda Films LLC [2006] FCA 591 at [19]; Costin v Duroline Products Pty Limited [2013] FCA 501 at [45]; McFarlane as Trustee for the S McFarlane Superannuation Fund v IOOF Holdings Limited [2018] FCA 692 at [65]. As Lindgren J expressed the position in Alphapharm Pty Ltd v Eli Lilly Australia Pty Ltd [1996] FCA 391: is there an obstacle consisting of the lack of key information which the prospective applicant needs to enable it to decide whether to commence a proceeding? 40 In the present case, Qudos relies on the evidence of Mr McKemmish. It submits that Mr McKemmish was unable to effect a comparison of the relevant source code in order to determine whether or not the AMB UX amounts to an infringing copyright work. Qudos relies on his second affidavit, summarised above, and also his third affidavit where Mr McKemmish says that because the prototype code of the Qudos UX was not in the same form as the production code of the AMB UX, he was not able to determine the extent of the similarities between the two. It further contends that it is unable to ascertain whether in developing the AMB UX, Infosys has misused its confidential information. 41 Infosys submits that there is no insufficiency of information. It contends that, objectively assessed, the information available to Mr McKemmish was sufficient and that a party cannot rely on preliminary discovery merely in the hope that it will be comforted in taking a decision in respect of which it already has sufficient information. It frames the relevant question as whether there is an obstacle consisting of the lack of key information which the prospective applicant reasonably needs to enable it to decide whether to commence a proceeding (citing Alphapharm Pty Ltd v Eli Lilly Australia Pty Ltd [1996] FCA 391 (Lindgren J) at [50]). In the present case, it submits that the conclusions reached by Mr McKemmish as to the common heritage of the Qudos and AMB UX/UI and the points of similarity to which he points, as well as any other information gleaned by Qudos from its assessment process, must provide a sufficient basis upon which Qudos can make a decision. It submits that Qudos has sufficient information to assess both the causal connection between the AMB UX/UI and the Qudos source material, and also the resemblance between the two. 42 I agree with Infosys as to causal connection. The evidence to which I have referred, pointing to the opportunities on the part of Infosys to have access to the code, UX and UI of the Qudos product, together with the common elements within the structure of the code and the unexplained references to Qudos-related data objects or variables in the AMB UX code such as "QCUBillerRequired" or QCUUserPasswordRequired", provide sufficient information for that purpose. 43 However, in the case of alleged copyright infringement a further central enquiry is whether or not there is sufficient similarity between the copyright material and the alleged infringement to amount to a substantial reproduction thereof. By way of example, section 36(1) of the Copyright Act relevantly provides that copyright in a literary work is infringed by a person who, not being the owner of the copyright, and without the licence of the owner of the copyright, does in Australia, or authorises the doing in Australia of, any act comprised in the copyright. One such act comprised in the copyright in the case of a literary work include reproducing the work in a material form: s 31(1)(a)(i). It is not necessary that those acts be done in respect of the whole of the literary work. That is because a reference to the doing of an act in relation to a work includes a reference to the doing of that act in relation to a substantial part of the work: s 14(1)(a). In the context of infringement, the test directs attention to the degree of originality in the expression of the part of the work reproduced: IceTV Pty Ltd v Nine Network Australia Pty Ltd [2009] HCA 14; 239 CLR 458 at [40] per French CJ, Crennan and Kiefel JJ. In IceTV, Gummow, Hayne and Heydon JJ said at [157] that the statutory requirement that the part of the work taken must be substantial assumes that there may be some measure of legitimate appropriation. Their Honours also said (at [158]): The case law does disclose that special difficulty has been encountered in considering the relationship between the phrase "a substantial part" in s 14(1) of the Act and the definition in s 10(1) of that species of "literary work" which is a "computer program", being: "a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result." (Emphasis added.) The phrase emphasised suggests the importance of function, although this is usually encountered in patent and designs law, rather than in the "traditional" law of copyright respecting original literary works. 44 The foregoing is not intended to be a complete exposition of the relevant law on the subject. Nor does it purport to summarise the totality of the case that Qudos seeks to bring. It does, however, point to the importance to the cause of action of forming at least a broad understanding of not only whether there has been copying, but as to the nature and scope of any copying in deciding whether to start a proceeding in the court to obtain relief. 45 The test for infringement in the context of a computer program was also discussed by Bennett J in CA, Inc. v ISI Pty Limited [2012] FCA 35; 95 IPR 424 at [173]-[179]. Her Honour said (at [178]-[179]): 178 It is apparent from IceTV and Data Access that special considerations may arise when considering whether or not a substantial part of a "computer program" has been taken. In IceTV, Gummow, Hayne and Heydon JJ referred to the importance of function in the determination of substantial part for "computer programs". Although the current definition of "computer program" introduced by the Copyright Amendment (Digital Agenda) Act 2000 (Cth) does not expressly refer to "function", unlike the former definition introduced by the Copyright Amendment Act 1984 (Cth), their Honours observed at [158] that the current definition nevertheless has a functional aspect. 179 In order to determine whether a substantial part of a computer program has been reproduced, the question is not whether one necessary integer of a computer program is present (IceTV at [159] per Gummow, Hayne and Heydon JJ; Data Access at [85]-[87] per Gleeson CJ, McHugh, Gummow and Hayne JJ). In IceTV, their Honours said at [159] that what is required is 'the need for some process of qualitative abstraction of the material features of the computer program in question'. This was in the context of a reaffirmation that what is entitled to protection is not the idea of the author but the fixed expression of that idea. 46 The evidence of Mr McKemmish indicates that he has been unable to form that understanding on the basis of the materials available to him. Properly understood, the evidence of Mr Michael does not disagree with that proposition. Mr Michael was specifically asked to address whether or not whether or not Mr McKemmish has sufficient information to determine whether the AMB code "contains any reproduction or adaptation". He does not address the question of whether he is in a position to assess the degree of reproduction or adaptation. This leaves Mr McKemmish's evidence as to the inadequacy of the information going to this question unchallenged. 47 In my view Qudos has established that after making reasonable inquiries it does not have sufficient information to decide whether to start a proceeding in the Court to obtain relief for infringement of copyright, breach of confidence and breach of contract. 48 I am satisfied that in order to make a meaningful comparison, it is necessary and appropriate for Qudos to be supplied with the source code that was prepared by Infosys from the stitched site of the Qudos UX/UI (that is, the code for the Qudos UAT site), and to be supplied with the February 2018 version of the AMB UX/UI source code. First, in a letter of 15 February 2018 Infosys refers to the Qudos UAT site being available on the internet. Mr McKemmish identifies the production code from the Qudos UAT site as being an appropriate comparator to enable a like for like comparison with the AMB UX code. The evidence indicates that the AMB site went live on 18 February 2018. Secondly, Qudos no longer has access to the UAT site or the source code underlying it, as confirmed in a letter from Infosys to Qudos on 9 October 2018. Thirdly, February 2018 was the time when employees of Qudos first noticed what they perceived to be close similarities between the AMB UX/UI and the Qudos UX/UI and observed that at least one Infosys employee was working on both projects. It was at this time that the first comparisons were made between the features of the UX for each. Fourthly, in February 2018 Qudos first raised its concerns of copyright infringement with Infosys. 49 These matters lead me to the view that it is appropriate that Qudos be provided with sufficient information to compare the source code of the Qudos UAT site with the AMB source code as both existed in February 2018; FCR 7.23(1)(b). I accept the submission advanced during argument by Qudos that it is in February 2018, before the allegations of infringement were first advanced, that an appropriate comparison may be made, because it is possible that subsequent changes to the software might serve to obscure the fact of any copying (in this regard, I hasten to add, I do not intend to convey any view one way or the other that this has or may have happened, deliberately or otherwise). There is no dispute that absent an order for production, this material would not be available to Qudos, but that Qudos reasonably believes that Infosys does have it. For the reasons stated, I consider it to be directly relevant to the question of the right of Qudos to obtain relief, and that it would assist it in making its decision; FCR 7.23(1)(c). However, I do not consider that it is necessary for Qudos to have access to be supplied with any change logs since this date. The comparison as at February 2018 should be sufficient. Nor am I satisfied that access to the AMB database and webserver is necessary. 50 I also accept that it is appropriate for Infosys to give production of documents recording the development and preparation of the AMB UX code prior to February 2018, such as minutes of meetings and correspondence between Infosys and AMB about that development and preparation. This will be reasonably necessary to enable Qudos to have sufficient information to decide whether there has been use made of what it contends to be its confidential information during the course of the creation of the AMB code. 51 I now turn to consider the scope of the order for discovery that should be made.

4.3 Qudos categories are overbroad and unclear 52 Infosys submits that FCR 7.23 requires the documents sought to be "directly relevant" to the claim that the prospective applicant reasonably believes may exist and that any discovery ordered be confined to the extent of information that is necessary, "but no more than that which is necessary" in order to overcome the insufficiency of information already possessed by the applicant. In this regard Infosys contends that even if there is some insufficiency of information available to Qudos, the categories pressed by Qudos extend well beyond what could be reasonably necessary to enable Qudos to decide whether to commence a proceeding. 53 I agree. In my view the categories proposed are prolix. They do not lend themselves to a clear understanding of the documents that are required. There are 18 numbered categories, one of which includes 6 sub-categories. The categories themselves include defined terms that are themselves extensive. For instance, a definition of "Qudos Provided Documents" is said to mean documents provided by Qudos to Infosys and then sets out a list of 22 sub-categories of documents ranging from "change requests" to "Qudos specific product rules" and "Error messages". This defined term is in 8 of the categories sought. Another definition states that the term "QCU Materials" has the meaning defined in cl 26.3(a) of the Master Banking Services Agreement which in turn refers generally to confidential information that is specific to QCU. To the extent that these categories seek production of materials that have been delivered by Qudos to Infosys, I would not require it to be supplied pursuant to FCR 7.23. Qudos has not demonstrated that it is unable from its own enquiries to ascertain what materials it supplied to Infosys. It should bear the burden of doing so. Otherwise, in my view the detail and verbosity of the categories is such that in my view there is some merit in the objection advanced by Infosys that production in accordance with them would be oppressive. 54 However, it is not necessary to address the various drafting difficulties that arise from the categories, because, although senior counsel for Qudos, Mr Richard Cobden SC, sought to defend the drafting during argument, ultimately he accepted that an alternative approach to the production of documents that would satisfy the requirements of Qudos is the production of the categories of document identified in [5] above. 55 In my view these documents will provide sufficient information for Qudos to be able to decide whether to start a proceeding in respect of the foreshadowed proceedings. This production may well fall short of the production to which Qudos may be entitled on discovery in the event that proceedings are commenced, but in my view it addresses the requirements of FCR 7.23.

4.4 Discretionary factors 56 Infosys advances several reasons to support the contention that the Court should in its discretion decline to make orders under FCR 7.23. First, it submits that the categories as articulated impose an oppressive burden of discovery. It submits that in giving discovery in accordance with the categories set out in the Amended Originating Application, many months of work will be required by a number of its employees. Secondly, it submits that the discovery sought is broader than necessary. 57 Understandably, these points address the categories set out in the Amended Originating Application. They do not address the rather simpler categories that were proposed during argument and which find their final form in [5]. Those categories do not suffer the drafting problem to which Infosys referred in argument and are in my view not likely to cause oppression of the type posed by the form initially proposed. Nor are they broader than necessary. Senior counsel for Infosys, Mr Hennessey SC, did not submit otherwise. 58 Thirdly, Infosys submits that it is unclear that Qudos has undertaken all relevant analyses of the materials that it already has. For the reasons set out in section 4.2 above, I do not consider that this is a factor militating against the grant of orders. Fourthly, Infosys contends that there has been an unexplained delay in bringing this proceeding. It submits that the formal dispute resolution processed under the Master Banking Services Agreement ceased on 12 April 2018 and yet the Originating Application was filed in November 2018. I have summarised the progress of the discussions between the parties in section 2 above. In my view the evidence is sufficient to indicate that prior to the issue of the proceedings Qudos was engaged in taking reasonable steps in an effort to resolve the dispute it had with Infosys more generally, and to ascertain information as to whether or not to commence the proceedings. 59 Fifthly, Infosys contends that Qudos has repeatedly changed its position in relation to production. Infosys voluntarily produced the AMB UX code in answer to Mr McKemmish's first affidavit and yet now is being asked to produce more material. There is perhaps some force in this submission insofar as Qudos was content to accept production of this software in the expectation that it would provide the relevant information, no doubt on instructions and with expert assistance. However, two principal items of information appear to have been missing from the production. One is the production code version of the Qudos UAT site (to enable like for like comparison), the other is the version of the AMB UX code as at February 2018 (to enable comparison at the relevant point in time). The first appears to have been based on a misapprehension on the part of Qudos as that the AMB UX code would also be supplied in the form of prototype code. The second is unexplained. Neither is the fault of Infosys. These matters may factor into the question as to the appropriate order to be made in relation to costs of the application, however, I do not think that they are sufficient to warrant the refusal of the relief sought. 60 Finally, Infosys submits that Qudos may well have decided already to commence proceedings in the context of its broader disputes with Infosys in relation to the performance of the Master Banking Services Agreement, and that any suggestion that discovery is necessary to assess whether litigation is worthwhile falls to be assessed in that context. However, the application is brought in the context of the specific questions posed under FCR 7.23 in circumstances where Ms Hansen, an officer of the court, has deposed to being unable to decide whether to start a proceeding in this Court to obtain relief for infringement of copyright, breach of contract and misuse of confidential information. I would not lightly set that to one side in the face of the speculative submission that a decision has already been made.

DISPOSITION 61 I will make orders that Infosys produce documents in accordance with the categories set out in [5] above. I am not satisfied that orders for production should be made against Infosys Technologies in light of the evidence of Ms Zavodnyik that the company has not been engaged in any relevant activities. Furthermore, it is not a party to the Master Banking Services Agreement. The orders I make also set a timetable for submissions in relation to costs. I certify that the preceding sixty-one (61) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Burley.

Qudos Mutual Limited v Infosys Limited

At a glance

Court

Decision date

Before

Source

Judgment (10 paragraphs)

Parties

Legislation Cited (4)

Cases Cited (8)

Cited By (1)