POL00416959
POL00416959
ord, haorce
eanree I
12 February 2010 Bond Pearce LLP
Ballard House
West Hoe Road
Plymouth PL1 3AE
Mr H Flemington
Royal Mail Group Ltd
Third Floor
100 Victoria Embankment
London Our ref:
EC4Y 0HQ $3D3/NIM1/348035.348
Your ref:
Dear Hugh
Potential deletion of Track II data from the Horizon System
I refer to our telephone conversation this afternoon.
1. Background
My understanding is that Track II data contains the 15-19 character primary account numbers relating to
customer transactions, expiry date of the card, information about what the card can be used for and how
it should be handled at the point of payment, and other discretionary data.
You believe that Track II data has to be destroyed to comply with PCI DSS, but seek advice as to the
potential impact upon Post Office Limited’s ability to bring and defend claims with subpostmasters.
Supostmasters act as agents for Post Office Limited and are contractually liable for any shortfalls at Post
Office Limited branches.
The litigation context is this: subpostmasters can, rightly or wrongly, seek to blame the Horizon computer
system when there is an unauthorised shortfall at a branch. They talk to each other on websites. A
recent example is the Justice for Sub Postmasters Alliance (jfsa.org.uk) who are a countywide action
group formed to represent alleged “victims of the system” and who are meeting Shoosmiths solicitors
today to discuss bringing litigation against Post Office Limited. Their perception is that there are serious
problems with the Horizon system.
The Horizon system is used in a network of around 11,300 Post Office® branches so it is essential that
the computer system is robust and seen to be robust. It is about confidence. In the event of a dispute it
is essential that the information that subpostmasters input into the system is accurately preserved.
2. Fujitsu’s advice
Fujitsu’s corporate legal counsel, Jean-Philippe Prenovost has stated in his email of 12 February 2010 to
you that if Track II data is destroyed, Fujitsu would not be able to testify that historical data is true,
accurate and (crucially) unchanged. You have asked him to clarify whether:
(a) Fujitsu are saying they don’t know whether this will affect the reliability of the system,
(b) whether they won’t know until they open the Track II data box; or
(c) whether the information will not be the same.
In response, he has admitted that he is not in a position to determine how the system operates and
suggests a meeting to bottom out each side’s respective understandings or concerns and I suggest that
this takes place as soon as practicable.
Bond Pearce LLP, a Limited Liability Partnership. Registered in England and Wales number 0C311430, Registered office: 3 Temple Quay Temple Back East
Bristol BS1 6DZ. VAT number GB143 0282 07. A list of members (all of whom are solicitors of England and Wales or registered foreign lawyers) of Bond Pearce
Is open for Inspection at the registered office. We use the word "partner" to refer to a member of the LLP, or an employee or consultant who is a lawyer with
equivalent standing and qualifications, Regulated by the Sollcitors Regulation Authority. www.bondpearce.com
6A_53634_1
POL00416959
POL00416959
Lok
POL00416959
POL00416959
3. Commercial litigation issues - preliminary advice
There may be three issues:
1. Whether the Track II data that it is proposed to be deleted could itself be useful and relevant in
pursuing or defending a claim against a sub postmaster. It is difficult to see how the Track II data
could be obviously relevant in litigation with subpostmasters. However, to be sure, we need to
bottom this out with Fujitsu.
2. If we are satisfied that the Track II data is irrelevant to litigation, could it definitely be deleted
without the risk of damaging other data? Initial indications from Fujitsu do not sound promising.
If it could be deleted without damaging other data, what would Fujitsu be willing to say ina
witness statement about the integrity of the Horizon system? The stronger Fujitsu could be, the
better and we should ascertain precisely what they would say.
Even if irrelevant data is deleted, this could be misconstrued as Post Office Limited trying to hide
data. At the very least it could create an unhelpful perception about data being changed. It may
be necessary on occasion to call evidence from Fujitsu to explain why deleted data is irrelevant
and dispel any misguided “conspiracy theories”.
3. If the deletion of the Track II data risks compromising other data on the Horizon system, then this
would be much more serious. It could adversely affect Post Office Limited’s ability to pursue or
defend subpostmaster litigation. To give an example of this, in Post Office Limited v Lee Castleton
[2007] EWHC 5 (QB), Post Office Limited brought a claim on accounts stated by one of its former
sub postmasters, the defendant Mr Castleton. Mr Castleton‘s case was that the losses shown in
the accounts were illusory and not real. He asserted that they were entirely the product of
problems with the Horizon computer and accounting system and that the apparent shortfalls were
nothing more than accounting errors arising from the operation of the Horizon system. The judge
heard evidence from Anne Chambers, a system specialist employed by Fujitsu. She was taken
through Horizon events logs and transaction logs by Mr Castleton who examined her about these.
She reached the conclusion that there was no evidence whatsoever of any system problem. The
judge accepted her evidence. If Ms Chambers had not been able to give that evidence because
the data she was examining had been corrupted, damaged or lost, it would have been much more
difficult to succeed. Mr Castleton was (and still appears to be) in a dialogue with other sub
postmasters who have grievances about the Horizon system, so word does get about. There are
other cases where the deletion of Horizon data would have been prejudicial. Even in cases where
the Horizon system may not be specifically challenged by the subpostmaster, Post Office Limited’s
ability to prove the accuracy of the historic Horizon logs will be important. In many debt and
fraud claims against subpostmasters, it is necessary to re-construct the entries into Horizon by
the subpostmaster. If, in such cases, Fujitsu is unable to provide an unqualified confirmation that
the historic Horizon logs are accurate, this could lead, in some cases, to difficulties in Post Office
Ltd proving its claim. Further, if it becomes standard practice for Fujitsu to provide qualified
confirmations, this risks a development of a perception among subpostmasters that the system is
not reliable.
I appreciate this preliminary advice is just one part of a larger jigsaw and there are competing risks
across the business. I recommend an urgent discussion with Fujitsu to understand the precise risks that
the deletion of the Track II data may have on the other parts of the system and what they would be
prepared to testify in Court should the Track II information be deleted.
Kind regards.
Yours sincerely
@
Di
Oo
Stephen Dilley
Senior Associate
for and on behalf of Bond Pearce LLP
www.bondpearce.com P22
6A_53634_1
POL00416959
POL00416959