In this decision, the Singapore High Court addressed the scope of compliance required under a pre-action discovery order, particularly concerning disclosure of user data. The case also considered whether public interest grounds could justify lifting the Riddick undertaking to notify the authority, Ministry of Home Affairs (MHA), of alleged lapses in identity verification. 

Salient facts  

The applicants, L’Oréal and La Roche-Posay Laboratoire Dermatologique, are part of a cosmetics group of companies holding registered trademarks in Singapore. The respondent, Shopee Singapore Pte Ltd, operates an online marketplace. 

The applicants obtained a pre-action discovery order for information on 18 sellers  allegedly selling unauthorized products. Shopee provided the required information of the 18 sellers, including their full names, ID and/or business registration numbers, addresses and contact details. 

Alleging that the disclosures were incomplete and inadequate, the applicants sought further orders, including: 

1. A compliance order for Shopee’s full compliance with the pre-action order; 

2. An explanation order on whether Shopee had verified the sellers’ data against government-issued documentation; 

3. A further production order requiring Shopee to obtain verified data; 

4. An ancillary order explaining Shopee’s efforts in obtaining the identity information and for its inability to do so in any instance; 

5. A non-disclosure order restraining Shopee from disclosing the proceedings with the sellers; and  

6. A notification order allowing the disclosure of Shopee’s alleged shortcomings to the MHA. 

Issues  

The issues to be determined by the High Court were as follows: 

1. Whether Shopee had fully complied with the pre-action order;  

2. Whether further information and/or explanations should be ordered;  

3. Whether Shopee should be restrained from disclosing the proceedings to sellers; and 

4. Whether permission should be granted to notify MHA of Shopee’s alleged deficiencies in identity verification. 

Issue A: Compliance with the pre-action order 

The applicants argued that Shopee failed to provide complete information of six sellers, particularly names and identification numbers. Shopee asserted that it had provided all information within its possession or control. The court accepted Shopee’s assertion, holding that Shopee had complied with the pre-action order to the best of its knowledge and belief. Mere absence of some information does not, in itself, establish non-compliance. 

Issue B: Further explanations and information 

The applicants claimed the data was “missing, bogus and/or unreliable”, and sought confirmation on whether verification had occurred. Shopee argued it was not obliged to verify or obtain data beyond what it held. It also noted that legal action could still be brought against the sellers through substituted service or the seller’s pseudonyms.  

The court found that substantial information, i.e., addresses, emails, and phone numbers for all 18 sellers had been provided to the applicants. The court stressed that each case must be assessed on its own facts. A bare assertion of “no records” will not always suffice, but in this case, the disclosures were adequate when viewed holistically. 

Issue C: Non-disclosure order 

The non-disclosure order was sought to prevent the sellers from being informed about the proceedings. As the further production order was dismissed, this consequential relief also failed, since the applicants had framed the non-disclosure order as ancillary to the further production order. 

Issue D: Notification to MHA 

The applicants sought leave to notify MHA of Shopee’s alleged identity verification deficiencies, which required lifting the Riddick undertaking. The applicants claimed that Shopee’s failure to verify seller identities posed public safety concerns. Shopee argued this was an abuse of process aimed at pressuring it into further disclosures and obtaining further information from the sellers.  

The court reiterated the high threshold for overriding the Riddick obligation. While it acknowledged that intellectual property infringement is serious, it held that this alone did not justify lifting the obligation. Comparing the risk of ecommerce scams to more severe threats (such as plans to commit heinous crimes against identifiable individuals), the court emphasized that only weightier public safety concerns could justify disclosure. The court further observed that affected consumers would be better placed to report such scams directly to the authorities. 

Conclusion 

The High Court dismissed the summons application in its entirety, concluding: 

1. Shopee had complied with the pre-action order to the best of its knowledge and belief; 

2. It was not plain and obvious to find that Shopee had failed to produce the required information or that the data was “missing, bogus and/or unreliable”; 

3. Shopee was not obligated to obtain information of third parties outside its control, and a further production order is inordinately intrusive; 

4. The non-disclosure order was not warranted; and 

5. The interests advanced for the extraneous use of the disclosed information do not outweigh the interests protected by the Riddick undertaking.