Norwich Pharmacal Orders: Unmasking Anonymous Wrongdoers

Someone has posted defamatory reviews about your business under a pseudonym, and the platform will not hand over the account details. Or a fraudster has talked a client into wiring money to an account, and the funds have vanished into a bank you have never dealt with. You cannot sue a defendant you cannot name, and you cannot trace money you cannot see. The obstacle in both cases is the same: the person who can identify the wrongdoer is not the wrongdoer.

The Norwich Pharmacal order is the tool that breaks this deadlock. It compels an innocent third party who has become "mixed up" in someone else's wrongdoing to disclose what they know — usually the identity of the wrongdoer, or the documents needed to trace stolen money — so that you can bring your real claim. It is an exceptional, discretionary remedy, not a routine fishing licence, and the courts guard it carefully.

This guide explains where the jurisdiction comes from, the three conditions you must satisfy, what these orders are used for, and how the remedy works in England & Wales and Hong Kong — including who pays, the position of banks, and the "no tip-off" restrictions that stop a respondent warning the wrongdoer.

Where the remedy comes from

The jurisdiction takes its name from Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133, a decision of the House of Lords. The patent holders knew their patent was being infringed by illegal imports but did not know the importers' identities. The Commissioners held that information but were not themselves infringing anything. The House of Lords held the Commissioners could nonetheless be ordered to disclose the importers' names.

... if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers.

That dictum of Lord Reid is the foundation of the whole jurisdiction. The key idea is that mere innocence is no answer: if you have become a conduit for another's wrong, even unknowingly, you can be required to help the victim identify and pursue the real wrongdoer.

The three conditions

The modern test was restated by the UK Supreme Court in The Rugby Football Union v Consolidated Information Services Ltd (formerly Viagogo Ltd) [2012] UKSC 55 — usually shortened to RFU v Viagogo. The RFU wanted the identities of people reselling Twickenham tickets in breach of conditions of sale; Viagogo's platform held that information. Lord Kerr set out three conditions:

a wrong must have been carried out, or arguably carried out, by an ultimate wrongdoer;
there must be a need for the order to enable action to be taken against that wrongdoer; and
the respondent must be mixed up in the wrongdoing so as to have facilitated it, and must be able (or likely to be able) to provide the information needed.

In plain terms: there has to be a real, arguable wrong; the disclosure has to be necessary to let you seek redress; and the respondent has to be more than a mere witness or bystander — they must have facilitated the wrong, even innocently. A pure onlooker who simply happens to know something cannot be made the target of a Norwich Pharmacal order.

Two cautions follow. First, these three conditions are necessary, but they are not the end of the inquiry: even where all three are met, the order remains discretionary. The court weighs whether disclosure is a necessary and proportionate response on the facts, balancing the applicant's need against the privacy and data-protection rights of the people whose details would be revealed — the proportionality analysis that was central to Viagogo itself. Second, the remedy is exceptional; the strength of your underlying case and the absence of any other practical route to the information both matter.

What these orders are used for

Unmasking anonymous online wrongdoers

The most common modern use is to identify anonymous defamers, fake-review authors and online harassers hiding behind a pseudonym. The order is directed at the platform, host or internet service provider that holds the registration data, IP logs or account details linking the handle to a real person. Once you have the identity, you can send a letter before action and bring a defamation or harassment claim against the right defendant.

Tracing assets through banks

Where money has been obtained by fraud, a victim can seek disclosure from the bank through which the funds passed. The leading authority is Bankers Trust Co v Shapira [1980] 1 WLR 1274, in which the Court of Appeal held it had jurisdiction to order a bank to disclose the state of, and the documents and correspondence relating to, the account of a customer apparently guilty of fraud, so as to give effect to the claimant's equitable right to trace. Orders of this kind are still called Bankers Trust orders, and they are frequently paired with a freezing injunction so the money cannot be moved while it is being traced.

Data breaches and intellectual property

The same machinery is used after a data breach to identify who leaked or misused information, and against intermediaries who can identify infringers of copyright, trade marks or other intellectual property — for example the operator of a site through which infringing goods are sold. In every case the principle is identical: the respondent is not the target of your eventual claim; it is the gateway to the person who is.

England & Wales

In England and Wales the governing jurisdiction is the original Norwich Pharmacal jurisdiction itself, applied through the three Viagogo conditions. An application is made to the High Court and supported by a witness statement (or affidavit) exhibiting the evidence that there is an arguable wrong, that the respondent is mixed up in it, and that the disclosure sought is both necessary and proportionate.

Banks, the duty of confidence and data protection

A bank cannot simply volunteer a customer's information, because it owes that customer a duty of confidence. That duty was established in Tournier v National Provincial and Union Bank of England [1924] 1 KB 461, where the Court of Appeal held the banker's duty of confidence is an implied term of the banker-customer contract, subject to four qualifications: where disclosure is compelled by law; where there is a public duty to disclose; where the bank's own interests require it; and where the customer consents. A Norwich Pharmacal or Bankers Trust order engages the first qualification — compulsion of law — which is precisely why a victim needs a court order rather than a polite request. The same proportionality and data-protection considerations that featured in Viagogo apply: the court will not order disclosure of personal data unless satisfied it is necessary and proportionate.

Who pays

Because a Norwich Pharmacal application is not ordinary adversarial litigation against the respondent — the respondent is usually innocent — the normal order is that the applicant pays the respondent's reasonable costs of compliance. The leading authority is Totalise plc v Motley Fool Ltd [2001] EWCA Civ 1897, [2002] 1 WLR 1233, where the Court of Appeal confirmed that the applicant ordinarily bears the innocent respondent's costs, while the court retains a discretion to depart from that rule — for example where the respondent has unreasonably opposed the application or is itself implicated beyond mere facilitation. Budget for this: in a bank-tracing case the compliance costs can be substantial.

Gagging and no-tip-off orders

An order is of little use if the respondent immediately warns the wrongdoer, who then deletes accounts or moves money. The court can therefore attach a confidentiality or "no tip-off" (anti-tip-off) restriction — a gagging provision — preventing the respondent from notifying the wrongdoer or anyone else for a defined period. This is a discretionary addition made on the facts, not an automatic feature, so you must ask for it and justify it in your evidence.

Hong Kong

Hong Kong has adopted the Norwich Pharmacal remedy under the court's inherent equitable jurisdiction. It is well established for fraud recovery, asset tracing and unmasking wrongdoers, and the Hong Kong courts apply essentially the same conditions as the English authorities. The application is commonly made as a standalone Originating Summons in the Court of First Instance, supported by affidavit evidence, with a parallel jurisdiction in the District Court within its financial limits.

Two features matter for cross-border fraud, which is where Hong Kong sees a great deal of this work. First, the Hong Kong courts have made disclosure orders reaching the records of overseas branches of banks present in Hong Kong, which is significant when stolen funds have been routed through the territory. Second, the jurisdiction has been confirmed in aid of post-judgment execution — so a Norwich Pharmacal order can be used not only to start a claim but to locate the assets needed to satisfy a judgment you already hold. Where your wrongdoer or their assets sit abroad, that connects with the separate question of enforcing a foreign judgment.

The same supporting doctrines apply. A Hong Kong bank owes its customer the Tournier duty of confidence, displaced here by the compulsion of a court order; gagging and no-tip-off provisions can be attached on the same discretionary basis; and the general costs position mirrors England — the applicant ordinarily pays the respondent's reasonable costs of compliance, although the Hong Kong courts have, on their facts, departed from that general rule.

Practical steps and the evidence you need

Whether you are in London or Hong Kong, the shape of an application is similar:

Identify the right respondent. It must be someone genuinely mixed up in the wrong who holds the information — the platform, host, ISP or bank — not a mere bystander.
Assemble the evidence of an arguable wrong. Your witness statement or affidavit must show, with exhibits, that a wrong has arguably been committed: the defamatory posts, the fraudulent transfer instructions, the infringing listings.
Show necessity. Explain why you cannot identify or pursue the wrongdoer by any other practical means, so the order is genuinely necessary to enable redress.
Define the disclosure precisely. Ask for the specific categories of information or documents you need — account-holder details, IP logs, account statements, tracing correspondence — not a sweeping fishing request.
Ask for a gagging order if you need one. Where tipping-off would defeat the purpose, seek a no-tip-off provision and justify it on the evidence.
Address costs and undertakings. Be ready to pay the respondent's reasonable compliance costs, and to give any undertakings the court requires about how the information will be used.

Once you have the identity or the tracing material, the order is a means to an end: pursuing the named wrongdoer, locking down assets with a freezing injunction, or opening settlement discussions — where without prejudice correspondence can protect your negotiating position while you press for recovery.

Norwich Pharmacal applications turn on getting the conditions, the evidence and the drafting right, and the procedure differs between courts. If you want to work out whether the remedy fits your situation and what to put in front of the court, Ask CommonBench's Legal Chat to talk it through against the leading authorities.

This guide covers general principles of the Norwich Pharmacal jurisdiction in England & Wales and Hong Kong and is not legal advice. Procedure, fees and authority differ between courts and change over time. Check the current rules for your specific court before applying.