NMC Healthcare Ltd & Ors v Neopharma LLC & Ors [2024] ADGMCFI 0013 (19 September 2024)

In the name of
His Highness Sheikh Mohamed bin Zayed Al Nahyan
President of the United Arab Emirates/ Ruler of the Emirate of Abu Dhabi

COURT OF FIRST INSTANCE

COMMERCIAL AND CIVIL DIVISION

IN THE MATTER OF THE INSOLVENCY REGULATIONS 2015

IN THE MATTER OF NMC HEALTHCARE LTD (in administration) (subject to a deed of company arrangement) AND THE COMPANIES LISTED IN SCHEDULE 1 TO THE ADMINISTRATION APPLICATION

and

IN THE MATTER OF THE INSOLVENCY REGULATIONS 2015

IN THE MATTER OF NMC HEALTH PLC (in administration)

BENJAMIN THOM CAIRNS AND RICHARD DIXON FLEMING (in their capacities as the joint administrators of NMC HEALTHCARE LTD (in administration) (subject to a deed of company arrangement), NMC HOLDING LTD (in administration) and NMC HEALTH PLC (in administration))

Applicants

(1) NEOPHARMA LLC

(2) NEXGEN PHARMA FZ LLC

(3) ERNST & YOUNG - MIDDLE EAST, trading as Ernst & Young Middle East (Abu Dhabi Branch)

Respondents

JUDGMENT OF JUSTICE SIR ANDREW SMITH

Neutral Citation:	[2024] ADGMCFI 0013
Before:	Justice Sir Andrew Smith
Decision Date:	19 September 2024
Decision:	1. The Third Respondent produce to the Applicants documents withheld pursuant to notices given under the order of 5 February 2024. 2. The Third Respondent have further time to comply with the order of 5 February 2024
Hearing Date:	9 September 2024 and 11 September 2024
Date of Orders:	To be drafted by the Applicants' representatives.
Catchwords:	Production of documents said to be prohibited by UAE legislation. Interpretation of UAE legislation. Status of ADGM and its Courts. Restrictions on auditors disclosing information. Court's jurisdiction to vary orders. Liberty to apply. Redacting documents for reasons of confidentiality.
Cases Cited	In re Mid East Trading Ltd [1998] BCC 726, 754D Bank Mellat v H M Treasury [2019] EWCA Civ 449 NMC Healthcare Ltd and ors v Dubai Islamic Bank PJSC and ors [2023] ADGMCFI 0017 NMC Healthcare Ltd and ors v Dubai Islamic Bank PJSC and ors [2023] ADGMCFI 0013 Case 216/2015 of the Dubai Court of Cassation Goel v Credit Suisse (Switzerland) Limited, Case no CA [2021] CA-002 A15 v B15 [2024] ADGM CFI 0012 Tibbles v SIG plc [2012] EWCA Civ 518 Cristel v Cristel [1951] 1 KB 725 Re Paragon Offshore Plc [2020] EWHC 2740 (Ch)
Legislation cited:	ADGM Insolvency Regulations 2022 Federal Law No. 12/2014 on the Regulation of the Auditing Profession Federal Law No. 41/2023 on the Regulation of the Accounting and Auditing Profession Federal Law No. 31/2021 on the Issuance of the Crimes and Penalties Law Federal Law No. 32/2021 on Commercial Companies Federal Law No. 2/2019 on the Use of Information and Communication Technology (ICT) in Health Fields Federal Decree-Law No. 45/2021 on the Protection of Personal Data Cabinet Resolution No. 48/2022 on the Implementing Regulation of Federal Law No. 12/2024 on the Regulation of the Auditing Profession Federal Law No. 34/2021 Concerning the Fight Against Rumours and Cybercrimes
Case Numbers:	ADGMCFI-2020-020; and ADGMCFI-2022-063
Parties and representation:	*Applicants* Mr Tony Beswetherick KC and Mr Matthew McGhee Instructed by DLA Piper UK LLP and Dr Mahmood Hussain, M & Co Legal. *Third Respondent* Mr James Brocklebank KC and Mr Jason Robinson Instructed by Clyde & Co LLP and Mr Faisal Alhazmi, Al Sahlawi & Co.

JUDGMENT

Introduction

1. The NMC Group of companies was the largest healthcare provider in the United Arab Emirates ("UAE"), operating more than 200 hospitals and other medical facilities. Its many operating companies in the UAE and elsewhere were owned by NMC Healthcare Ltd ("NMCH"), a company incorporated in the Abu Dhabi Global Market ("ADGM"). NMCH's parent company was NMC Health plc ("NMC plc"), an English company, registered on the London Stock Exchange.

2. By order of the English High Court made on 9 April 2020, the applicants, Mr Benjamin Thom Cairns and Mr Richard Dixon Fleming, of Alvarez & Marsal Europe LLP ("A&M") (the "JAs"), together with Mr Mark Firmin, also of A&M, were appointed as the administrators of NMC plc. On 27 September 2020, the JAs were appointed as the joint administrators of NMCH, NMC Holding Ltd ("Holding") and 34 other companies, all being companies registered in the Abu Dhabi Global Market ("ADGM"). By an Application Notice dated 23 March 2023 (the "2023 Application"), the JAs, in their capacities as administrators of NMC plc, NMCH and Holding, brought proceedings for relief under sections 255 and 256 of the ADGM Insolvency Regulations, 2022 (the "Insolvency Regulations") against (as it is put in the Application Notice) "Ernst & Young - Middle East, trading as Ernst & Young Middle East (Abu Dhabi Branch)" and two other Respondents.

3. Ernst & Young - Middle East ("EYME") is a Bahraini specialised partnership company, with four branches in the UAE. The Abu Dhabi branch of EYME, which was referred to on these applications as "EYAD", is an "onshore" entity, registered and licensed by the Abu Dhabi Department of Economic Development. Another branch of EYME is registered in the ADGM as a "Branch of a Foreign Partnership".

4. I determined the 2023 Application in my judgment of 5 December 2023 ([2023] ADGM CFI 0022 (the "December Judgment"). I granted the JAs relief against EYME under section 256 of the Insolvency Regulations, but I did not grant relief under section 255. Section 256 provides (inter alia) that, on the application of administrators (and other office-holders), the Court may exercise a discretion to order persons to produce documents relating to the companies in administration or its dealings.

5. In the December Judgment, I explained (at para 4) that on 21 September 2021 NMCH and the other companies in ADGM administration other than Holding entered into Deeds of Company Administration ("DOCAs") to enable the other companies to continue trading. Pursuant to the DOCAs, the ADGM companies other than NMCH and Holding came out of administration and assigned to NMCH claims in respect of losses leading to the administrations. In evidence in support of the 2023 Application, Mr Fleming said these companies, together with their subsidiaries, had given consent for all information and records sought under the 2023 Application to be delivered to the JAs, and that they had confirmed that they waive any privilege in the records. He also said that the JAs had not been able to obtain such consent or waiver from three companies whose documents it sought, namely (i) B R Medical Suites FZ LLC, which is no longer an active company; (ii) Cooper Healthcare LLC, which had been a subsidiary of one of the companies put into administration, NMC Royal Women's Hospital Ltd, but had since been sold; and (iii) Trans Arabia Drug Store LLC, which had been sold before 27 September 2020.

6. I explained the nature of the 2023 Application in the December Judgment, and I need not repeat the explanation in detail. At paragraphs 110ff, I explained that one of purposes (but not the only purpose) of the JAs in making the 2023 Application against EYME related to proceedings for damages (the "English proceedings") brought in the English Commercial Court by NMC PLC brought against Ernst & Young LLP ("EY"), its statutory auditor, alleging that the audits were not conducted with proper skill and care. EYME did not audit NMC PLC itself, but it conducted local or "component" audits of companies, including NMCH, that fed into the Group audit and similarly contributed to EY's interim reviews.

7. In opposition to the 2023 Application, EYME argued, under a heading in its skeleton argument "EYAD's potential exposure to sanction under onshore Abu Dhabi law", that an order against EYME would "[risk] exposing EYAD to breaches of statute and criminal sanctions in onshore Abu Dhabi", "the risk that EYAD will be in breach of applicable Abu Dhabi law and exposed to prosecution is and that an important factor weighing against the making of the order". In the December Judgment, I considered this at paragraphs 126 to 135. Having expressed some doubt about EYME's arguments, I explained at paragraph 134 that, in any case, the JAs had proposed a formula for dealing with these concerns that appeared to afford EYME appropriate protection.

8. Following the December Judgment, by an order of 5 February 2024 (the "February Order"), I ordered (among other things) at paragraph 18 that, to the best of its knowledge, information and belief, EYME should produce the following documents to the JAs by specified deadlines:

a. "By 4.00 pm on 13 February 2024, so far as then available, and the remainder by no later than 4.00 pm on 8 March 2024, copies of any engagement letters or written agreements entered into between [EYME] and any of entities within the NMC Group relating to the services that [EYME] provided to such entities between 2009 and 2019, and any terms and conditions governing the provision of such services": the "Category 1 documents";

b. "By 4.00 pm on 13 February 2024, so far as then available, and the remainder by no later than 4.00 pm on 8 March 2024, a copy of the data from [EYME's] accounting system which shows the fees and other charges levied to and sums paid by and received from any of the NMC Group entities": the "Category 2 documents";

c. "Copies of [EYME's] audit files (whether electronic or hard copy) relating to the audit services that it provided as follows: (i) The group audit files in respect of [NMCH] in the period 2012 to 2019 and [NMC PLC] in the period 2012 to 2019, by no later than 4.00 pm on 22 March 2024; (ii) The statutory audit files in respect of [NMCH] in the period 2011 to 2019 and [NMC PLC ] in the period 2012 to 2019, and the group audit files in respect of [NMCH] in the year 2011, by no later than 4.00 pm on 10 May 2024; (iii) The group and statutory audit files in respect of the [certain other NMCH Group companies] in the period 2011 to 2019, by no later than 4.00 pm on 5 July 2024; (iv) The group and statutory audit files in respect of [Holding] and [certain other NMCH Group companies for specified years], by no later than 4.00 pm on 2 August 2024": the "Category 3 documents", and as for sub-categories, respectively the "Category 3(i) documents", the "Category 3(ii) documents", the "Category 3(iii) documents" and the "Category 3(iv) documents".

d. "By no later than 4.00 pm on 5 July 2024, copies of reports and working files (whether electronic or hard copy) held by [EYME] relating to the financial and operational review work undertaken for any NMC Group entities pursuant to an engagement agreement of 24 August 2011, being records held in relation to 'Project Nightingale' and copies of all working papers in relation to the same": the "Category 4 documents"; and

e. "By no later than 4.00 pm on 10 May 2024, copies of reports and working files (whether electronic or hard copy) held by [EYME] relating to the work it undertook with respect to its engagement linked to the [NMC plc] board's investigations into allegations that had been made by a former shareholder": the "Category 5 documents".

9. The February Order also included a provision at paragraph 20 that reflected the formula proposed by the JAs for meeting the concerns of EYME risking contravention of UAE law and sanctions. It provides as follows: "If [EYME] believes that producing any of the documents in compliance with paragraph 18 above would give rise to a real risk that it would be in contravention of the law of a jurisdiction either in which [EYME] operates or in which the documents are stored, then by the applicable dates for production in paragraph 18 above, [EYME] shall notify the [JAs] in writing of those documents and identify the statutory provisions which [EYME] relies on. Notwithstanding the obligation in paragraph 18, on provision of such a notice, [EYME] will not be obliged to produce such documents unless otherwise ordered by the Court".

10. I declined the JAs request that a penal notice be attached to the February Order.

11. Pursuant to the February Order:

a. On 5 April 2024, EYME produced the Category 1 and Category 2 documents other than documents relating to two companies, Cooper Healthcare LLC and Trans Arabia Drug Store LLC, but on 9 April 2024, by a letter from its solicitors, Clyde & Co, it served a notice under paragraph 20 of the Order (a "Paragraph 20 Notice") that it considered there to be a real risk of contravening UAE law should the remaining documents be produced. By the same letter of 9 April 2024, EYME gave a Paragraph 20 Notice in respect of all the Category 3(i) documents.

b. On 10 May 2024, by another letter from Clyde & Co, EYME gave a further Paragraph 20 Notice that it considered there to be a real risk of contravening UAE law should it produce any documents in category 3(ii) or category 5.

12. The Paragraph 20 Notices were served after the time specified in the February Order, but no point is taken by the JAs on that.

13. Paragraph 20 Notices have not been served in respect of the remaining categories of documents, but my decision on the two Paragraph 20 Notices that have been served will, in all likelihood, resolve any issues about the other documents.

The Applications

14. This is my judgment on two applications. By an application dated 6 May 2024, EYME sought extensions of the deadlines for compliance with their outstanding disclosure obligations under the February Order (the "Extension Application"). It was listed for hearing on 13 June 2024. However, by an application dated 12 June 2024 (made after papers and skeleton arguments for the hearing had been filed and served), the JAs applied to lift the stay on disclosure engaged by the Paragraph 20 Notices (the "Foreign Law Application"). It was obviously sensible for the two applications to be heard together, and the hearing on 13 June 2024 was adjourned.

15. By an application of 28 June 2024, the JAs applied for directions that questions of foreign law arising on the Foreign Law Application should be dealt with by legal submissions, in accordance with the ADGM Court Procedure Rules 2016 (the "CPR"), r.117. By another application of 28 June 2024 (the "Expert Evidence Application"), EYME applied for permission to adduce expert evidence about foreign law. By a judgment of 9 July 2024 [2024] ADGM CFI 0008 (the "July Judgment"), I refused the Expert Evidence Application, and by an order of 24 July 2024, I directed that issues of foreign law should be dealt with by legal submissions.

16. By a letter of 30 August 2024 to the Court from its solicitors, Clyde & Co, EYME stated that it will require yet more time to comply with its obligations, and that even those further extended dates might need to be revised.

17. I heard the adjourned Extension Application and the Foreign Law Application on 9 and 11 September 2024. The JAs were represented by Mr Tony Beswetherick KC and Mr Matthew McGhee, both of English counsel, and Dr Mahmood Hussain of M & Co Legal, a UAE law firm. EYME was represented by Mr James Brocklebank KC and Mr Jason Robinson, both of English Counsel and Mr Faisal Alhazmi of Al Sahlawi & Co, a UAE law firm.

The Foreign Law Application

18. I shall first deal with the Foreign Law Application. I observe at the outset that EYME perceived that it faced criticism from the JAs and their representatives for creating unwarranted difficulties and adopting delaying tactics so as to avoid the consequences of the December Judgment and compliance with the February Order. It is not clear to me how far the JAs and their representatives intended or pursued such criticism, but I should say this: while I can well understand that the JAs find frustrating the delay in production of documents to which they are prima facie entitled, there is not any real evidence that EYME is doing anything other than making bona fide attempts, and expending considerable resources, to comply with its demanding obligations under the February Order. In any case, this is a distraction from the important issues on the Foreign Law Application.

The UAE laws on which EYME relies

19. EYME's arguments that it should not be required to produce documents are based upon these statutes:

a. Federal Law No. 12/2014 on the Regulation of the Auditing Profession (the "2014 Auditors Law"), together with Federal Law No. 41/2023 on the Regulation of the Accounting and Auditing Profession (the "2023 Auditors Law");

b. Federal Law No. 31/2021 on the Issuance of the Crimes and Penalties Law (the "Penal Code");

c. Federal Law No. 32/2021 on Commercial Companies (the "Commercial Companies Law"); and

d. Federal Law No. 2/2019 on the Use of Information and Communication Technology (ICT) in Health Fields (the "Healthcare ICT Law").

20. EYME also relies on Federal Decree-Law No. 45/2021 on the Protection of Personal Data ("Data Protection Law"), but it does not contend that this Law prevents it producing documents, but only that it should be permitted to redact information that it is prohibited from providing to the JAs under the Data Protection Law.

21. The February Order required that EYME identify in its Paragraph 20 Notices the statutory provisions on which it relies. Both Paragraph 20 Notices identified the 2014 Auditors Law, the 2023 Auditors Law, the Penal Code, the Commercial Companies Law and the Data Protection Law. Only the notice of 10 May 2024 identified the Healthcare ICT Law, but the JAs do not argue that this prevents them from relying on it in respect of all the categories of documents.

22. The Paragraph 20 Notices also referred to the Cabinet Resolution No. 48/2022 on the Implementing Regulation of Federal Law No. 12/2014 on the Regulation of the Auditing Profession (the "2014 Auditors Law Implementing Regulations"). Further, they both also express concern that production of documents will place EYME at real risk of contravening UAE public policy: the Notices said that considerations of public policy arose in particular in circumstances "where: (a) at least some of [the] documents will be used in relation to foreign proceedings and therefore removed from the jurisdiction of the UAE; and (b) some of the documents to be produced contain Sensitive Personal Data relating to individuals' health and family, and especially where it is foreseeable that some of that data may relate to Emirati nationals". (The "foreign proceedings" are the English proceedings. I explain the term Sensitive Personal Data" at paragraph 86 below.) In its submissions on the Foreign Law Application, EY did not develop any argument about the 2014 Auditors Law Implementing Regulations, nor did it advance public policy arguments of the kind referred to in the Paragraph 20 Notices. I need say no more about them.

23. For completeness, I mention that, in the course of these proceedings, EYME has relied on article 45 of the Federal Law No. 34/2021 Concerning the Fight Against Rumours and Cybercrimes. The Paragraph 20 Notices did not refer to this statute, but earlier in the proceedings, EYMA had done so (see the December Judgment, para 127), and in a subsequent witness statement, Mr Anthony O'Sullivan, EYME's Managing Partner, said that EYME "reserve[d] its rights" to rely upon this article, without indicating its relevance. Mr Brocklebank accepted that, if EYME's argument does not succeed in its other arguments, it cannot succeed under Law 34/2021.

EYME's arguments about the production of documents based on UAE Law

24. In the December Judgment (at para 129), I rejected EYME's argument that, because of concern that disclosure of information might contravene UAE law, therefore no order should be made against it. I said that I could not accept that a risk of criminal or civil liability was a complete answer to the JAs' application, and said that it was "only a factor, albeit potentially an important factor, to be brought into account together with other considerations", citing the judgment of Chadwick J in In re Mid East Trading Ltd [1998] BCC 726, 754D. Similarly, in the July Judgment, I expressed a provisional view that Mr Mark Beswetherick of Clyde & Co was right in his witness statement of 28 June 2024 in support of EYME's Expert Evidence Application that the "core issue for the [Foreign Law] Application is whether [EYME] is exposed to a real risk (and if so what risk) of sanction by onshore UAE Courts and authorities", and that in those circumstances the Court should adopt the approach explained in Gross LJ's judgment in Bank Mellat v H M Treasury [2019] EWCA Civ 449 and balance the risk of a party facing prosecution or sanctions against the importance of production of the documents. This argument was referred to at the hearing as the "Bank Mellat Argument", and I shall adopt that label.

25. In his submissions on the Foreign Law Application, Mr Brocklebank advanced a rather different argument for EYME: he did not dispute that the approach in the Bank Mellat case should be adopted to a contention that the production of documents would give rise to a risk of prosecution or sanctions in a foreign (non-UAE) state, but he submitted that another question arises when this Court, a Court of the UAE, is considering an argument that production would contravene UAE law. He submitted that this Court "ought not to make an order that risks infringement of UAE law", and argued that here (i) the question of whether a convention would in fact result in sanction is irrelevant, and (ii) the Court should not weigh the risk of contravening the law against the importance of the disclosure to the recipient.

26. I accept that this Court should not make an order against EYME if I determine that it would require EYME to act in breach of UAE law, and that this provides EYME with an alternative argument to the Bank Mellat Argument. Without intending to be pejorative but for ease of reference, I shall call it the "New Argument", This leads to two further questions. First, is the New Argument engaged if there is a (mere) risk of an order requiring a person to act in breach of UAE law, or only where the Court concludes that an order would require a person so to act? In my judgment, the New Argument requires the Court to determine whether UAE law would be breached: a risk that it might do so does not suffice. By the end of the hearing, Mr Brocklebank accepted this.

27. The second question is whether the New Argument is engaged by regulatory contraventions. EYME accepted that civil liability, or a risk of civil liability, is not sufficient to engage either the Bank Mellat Argument or the New Argument. However, it contended that in both cases breach of a regulatory regime is sufficient: the rationale for the distinction, Mr Brocklebank suggested, is that, when it is concerned with regulations, as with penal provisions, the Court is constrained by respect of foreign law and foreign authority. I accept that the risk of a regulatory sanction can support a Bank Mellat Argument, and the JAs did not contend otherwise. However, I did not hear full argument on this point with regard to the New Argument. I am not persuaded that the Court will necessarily be restrained from making an order that requires contravention of a regulatory regime, although the Court would no doubt take that into account when deciding whether to make an order of this kind. It is not necessary for present purposes to reach a concluded view about that question, and I shall not do so.

Interpretation of the UAE Federal Statutes

28. Before I consider separately the statutes on which EYME relies, I should consider in more general terms some principles of UAE statutory interpretation, and the application of UAE statutory provisions to the Financial Free Zones ("FFZs") of ADGM and the Dubai International Financial Centre ("DIFC").

29. Dr Hussain referred to article 1 of Federal Law 5/1985 On the Civil Transactions Law of the UAE State (the "Civil Code"). Article 1 provides that legislative provisions shall be applicable to all matters therein, in letter and in context. Dr Hussain submitted that, accordingly, the Court may and should have regard to the purpose or intention of a legislative provision when interpreting it, and that one aspect of this principle is that the Court should reject a statutory interpretation that leads to an illogical or absurd result, which cannot have been the legislator's intention. I accept that submission. (I observe in passing that in this regard the principles of statutory interpretation are similar to those of contractual interpretation: see NMC Healthcare Ltd v Dubai Islamic Bank PJSC [2023] ADGM CFI 0017).

30. Dr Hussain also referred to article 262 of the Civil Code: "The absolute shall be given effect without limitation unless it is limited by an express provision or tacitly". He submitted that principles of the Civil Code relating to the interpretation of contracts in Book 1, Chapter 1 Section 4, and in particular that in article 262, apply to the interpretation of statutes. I did not understand this to be disputed, and I accept it: indeed, it seems to me that the principle in article 262 is broadly similar to the principle that "Exceptions may neither be applied by analogy not receive extended interpretation", which is stated at article 30 in Chapter 2 of the Civil Code, entitled "Certain Doctrinal Principles and Rules of Interpretation" (although neither party cited this Chapter).

31. I should refer to another point about statutory interpretation that appears to be common ground, or at least upon which both parties placed apparent reliance. Literal and general wording in one statute may be impliedly qualified by the specific provisions of another law. This is reflected in article 56 of the Penal Code, which provides that, "There shall be no crime if the act is committed in the performance of a duty imposed by the law, if the person who commits such act is legally authorized thereto". Thus,

a. Some statutory provisions might, on a literal reading, prohibit auditors from discussion with the client company of information that it receives from third parties in the course of an audit: for example, information provided by a bank about outstanding balances that might appear inconsistent with the company's records. Mr Brocklebank contended that this is permitted because article 248 of the Commercial Companies Law, which stipulates the duties of an auditor, requires that the auditor share such information in the course of the audit. He deployed this argument to refute the suggestion that because an auditor is entitled to share information in the course of an audit, the legislation on which EYME relies must be understood to allow auditors in other circumstances to disclose to their clients information that they have obtained from third parties.

b. For their part, as I shall explain, the JAs contend that the general prohibition in the Penal Code on disclosure of a secret entrusted to a person by reason of his profession does not apply where disclosure is permitted by the specific provisions of the 2023 Auditors Law that allow auditors to disclose information in specified circumstances. Mr Brocklebank did not dispute this.

32. Accordingly, Mr Hussain submitted that, upon questions about the application of statutes to auditors and accountants generally, it is therefore relevant to have in mind the requirements of International Accounting Standards and the International Standards on Auditing, which auditors are required to apply under the Ministerial Decision No 403/2015 On the International Standards for the Auditing Profession.

The application of UAE laws to ADGM

33. As I shall explain in more detail when considering the various statutory provisions, there are issues between the parties about whether references in UAE legislation to the law or the laws or judicial decisions are to be understood to include the law of the ADGM or orders of this Court. I alluded to such questions in the December Judgment, where I said this (at para 131):

"...all the legislation to which Mr Brocklebank referred unsurprisingly excluded from the prohibitions disclosure that is required or permitted by law. On the face of it, I would expect [a legislative provision that excepts what is required or permitted by a Court of the UAE] to exempt from the prohibitions disclosure required by any Court of the UAE, and that an order of this Court, being a Court of the Emirate of Abu Dhabi, would bring EYME within the exceptions. Certainly, other litigants in this Court have been content that an order of this Court would mean disclosure would be 'authorised by law' within the meaning of section 120 of Federal Law 14 of 2018, Regarding the Central Bank & Organization of Financial Institutions and Activities: see NMC Healthcare Ltd and ors v Dubai Islamic Bank PJSC and ors, [2023] ADGMCFI 0013 esp at para 5".

34. I was not expressing concluded views about this in the December Judgment, and I did not hear full submissions on the question when it arose in relation to Federal Law 14/2018. Further, as Mr Brocklebank rightly observed, the question requires separate consideration in respect of different statutory provisions, in light of their precise wording and context. I shall therefore come directly to these issues when I consider the various statutes on which EYME relies. However, both parties made more general points in support of their contentions about the status of FFZs, specifically the ADGM, in the UAE and of this Court and its orders.

35. FFZs may be established in the UAE pursuant to Federal Law 8/2004. It provides that FFZs may be established by a federal decree (article 2) and that they and financial activities in them are subject to all federal laws, apart from federal civil and commercial laws. Financial activities are defined in article 1: they include "financial and banking activities and services, insurance and re-insurance, financial markets and supporting activities licensed to be carried on in the [FFZ]"; and supporting activities are defined as "financial and cash brokerage services and advice, and the provision of goods and services to Companies and Establishments and individuals in the [FFZ]".

36. In accordance with Federal Law 8/2004, the ADGM was founded as a FFZ under Abu Dhabi Law 4/2013 (the "Founding Law"), which was amended by Abu Dhabi Law 12/2020. Article 2 provides that the ADGM shall have an "independent legal personality and full legal capacity, as well as financial and administrative independence", and shall be "affiliated" to the Government of Abu Dhabi.

37. Article 6 provides that the Board of Directors of the ADGM shall be the highest authority in the ADGM and "shall have the competence to develop strategies and general policies for the [ADGM] and follow up on their implementation to achieve the objectives for the [ADGM]. Said Board may exercise all powers and competencies necessary in this regard without affecting the independence of the [ADGM's] authorities, and shall in particular undertake to carry the following: 1. Issuing the [ADGM] Regulations related to the organization of work of [the ADGM] and achievement of objectives thereof ...". The objectives of the ADGM are stated in Article 3: "The [ADGM] aims at the promotion of [Abu Dhabi's] position as a leading global market and at developing [Abu Dhabi's] economy so that it constitutes a sound environment to attract financial investment and contribute effectively in the field of international financial services". The Insolvency Regulations were made by the Board pursuant to its powers under Article 6.

38. The ADGM Courts are established under Article 13 of the Founding Law, and Article 13(2) provides that judgments of the ADGM Courts shall be rendered in the name of the Ruler of Abu Dhabi. The Courts' jurisdiction is statutory, being defined by article 13(7) of the Founding Law, as amended. Article 13(1) provides that the ADGM Courts "are considered to be the Emirate's [sc Abu Dhabi's] courts and shall settle the disputes and matter according to the provisions of the present Law and the [ADGM's] Regulations".

39. The law of the ADGM derives from the common law, whereas the federal legal system is a civil law system, which has much in common with and is much influenced by Egyptian law, and therefore indirectly by the Napoleonic Code. Mr Brocklebank submitted that, when this Court considers UAE law, it does so "on the basis that they are part of a foreign law". While Mr Brocklebank might be using the terms "foreign" in an extended sense, his point that the legal regime of the ADGM is distinct from that in the rest of the UAE is undeniable. He therefore describes that ADGM as "sit[ting] outside and apart from the onshore UAE jurisdiction". Mr Alhazmi submitted that the ADGM is properly described as an "exceptional" jurisdiction, whereas the civil law Courts are often described in their judgments as the "ordinary" Courts. He cited by way of example Case 216/2015 of the Dubai Court of Cassation, in which it was held "ordinary courts have general jurisdiction over all types of disputes, regardless of the parties thereto, unless the jurisdiction is determined under a provision of the Constitution or law, or vested in another body as an exception".

40. Dr Hussain emphasised in his submissions that the FFZ Courts are "an integral part of the UAE legal system" and that they are not "isolated within it". Judgments of the ADGM Court, he argued, carry the same weight and authority as those of other UAE Courts. He cited a judgment of the DIFC Court of Appeal in Goel v Credit Suisse (Switzerland) Limited, [2021] CA-002, which concerned a jurisdiction clause in contracts of guarantee, whereby the guarantors had agreed that the "Courts of Dubai" should have jurisdiction over disputes. The Court of Appeal held that, on its proper construction, this wording conferred jurisdiction on the Courts of the DIFC. The Court of Appeal said this: "It is a constitutional fact in the Emirate of Dubai, that the courts of Dubai are the courts created by the Laws of the Emirate. When the term 'the courts of Dubai' is used in a contract the ordinary meaning, absent context and purpose pointing in a different direction, refers to all the courts of Dubai" (at para 89). It continued, "The cases point to a default position in which the DIFC [Court of First Instance] is included within the terminology 'the courts of Dubai' along with the onshore courts" (at para 91). As I explained in my judgment in A15 v B15 [2024] ADGM CFI 0012, a similar approach is taken by the civil law Courts to identifying the seat of an arbitration when the seat is agreed to be the "Courts of Abu Dhabi" or the "Courts of Dubai".

41. The parties also referred to the regimes for enforcing the judgments and orders of the ADGM Court. Dr Hussain submitted that judgments of this Court can be enforced throughout Abu Dhabi and elsewhere in the UAE under Federal Law 10/2019 On the Regulation of Judicial Relationships between Federal and Local Judicial Authorities, which provides at Article 10 that "Every final or enforceable judgment or any judicial order issued by a Federal or Local Judicial Authority shall be enforceable throughout the State according to the legislation in force in the State", the "State" being defined as the UAE. "Federal or Local Judicial Authority" is defined as "Federal or local judicial entities including Courts and Public Prosecutions". EYME dispute that they include the Courts of the ADGM: Mr Brocklebank observed that the statutes recited in Law 10/2019 do not include either Federal Law 8/2004 or the Founding Law. I shall assume, without deciding, that EYME are right about this. I also note that Mr Brocklebank submitted that this exemplifies more generally that the ADGM Courts and the UAE judicial system are distinguished in UAE statutes.

42. Accordingly, EYME argues that judgments of the Courts of the Abu Dhabi Judicial Department ("ADJD") are not directly enforceable in the ADGM, nor vice versa, and the machinery for enforcing ADGM Court decisions outside the ADGM is set out in the Memorandum of Understanding between the Judicial Department of the Emirate of Abu Dhabi and the ADGM Concerning the Reciprocal Enforcement of Judgments of 11 February 2018 (the "MOU"). Paragraphs 11 to 18 are about the enforcement of judgments of the ADGM Courts by the ADJD. Paragraph 12 requires that in order to be enforced by the ADJD, an ADGM judgment must have affixed to it a prescribed "execution formula". Paragraph 13 of the MOU provides that "ADJD shall enforce the judgments issued by ADGM Courts based on an application directly submitted by the judgment creditor to ADJD, subject to the applicable ADJD legal procedures". Paragraph 14 provides that "If a judgment creditor registers a judgment issued by ADGM Courts for enforcement at ADGM Courts, and such enforcement requires actions or measures to be taken by ADJD, the enforcement judge of ADGM Courts may deputise an enforcement judge of ADJD pursuant to a letter addressed to the director of ADJD's Enforcement Division, indicating the measures or actions to be taken, enclosing [specified documents]". Paragraph 15 provides that the ADJD Courts, when applying enforcement procedures according to paragraphs 13 and 14, shall apply the enforcement procedures according to Federal Law 11/1992 and shall not re-examine the merits of the ADGM judgment.

43. As Mr O'Sullivan explained in his witness statement of 25 July 2024, it is therefore EYME's case that, in accordance with the MOU, and other memoranda of understanding entered into between 2016 and 2019, ADGM Court judgments and orders are not directly enforceable elsewhere in the UAE otherwise than pursuant to the mechanism so agreed. Thus, as Mr Alhazmi submitted, a judgment creditor may face challenges when seeking enforcement in the ADJD, including challenges on the basis of public policy: indeed, an objection of public policy might be raised by the ADJD Court itself of its own motion. Mr Beswetherick did not argue otherwise, and I accept EYME's submissions about this.

44. EYME has accepted by a letter from Clyde & Co dated 28 June 2024 that, where it is permitted to produce documents "required by law", it would suffice if an order of the ADGM Court were recognised and enforced by the ADJD pursuant to the MOU. However, it disputes that otherwise an order of this Court suffices and observes that that the JAs have in fact taken no steps to enforce the February Order in the ADJD. This does not seem to me relevant to the matters that I have to decide on these applications. I add that it is not surprising that the JAs have not sought to enforce the February Order under the MOU: they could not have done so in respect of documents that are the subject of a Paragraph 20 Notice.

45. As I have said, I accept Mr Brocklebank's submission that each of the statutes on which EYME relies is to be interpreted according to its own terms, and various references to "the law(s)" or "regulations" or "judicial authority" must be interpreted in their context. I observe here, however, that the Insolvency Regulations (and other Regulations of the ADGM) are made pursuant to the Founding Law by the body upon which authority to make them was conferred. Similarly, the ADGM Court was created, and exercises its jurisdiction, under the Founding Law. The fact that regulations created by the Board are interpreted in accordance with common law principles and that the ADGM Courts' jurisdiction is confined to the limits specified by the Founding Law and might in that sense be termed specific or "special", rather than general or "ordinary", are largely beside the point. Nor does it seem to me that the status of the ADGM Regulations and the ADGM Courts' orders is materially different because other judicial authorities are involved in enforcing them in other parts of Abu Dhabi and the UAE.

The 2014 Auditors Law and 2023 Auditors Law

46. I therefore come to consider the various statutory provisions on which EYME relies, and I start with the 2014 Auditors Law and the 2023 Auditors Law. Article 12(1) of 2014 Auditors Law provides as follows:

"The auditor whose name was accepted to be registered in the record of the auditors practising the profession, shall, before starting the work, sign the following undertaking: 'I undertake to carry out my works in all honesty and honour, to respect the laws of the State, to preserve the integrity of the profession and respect its traditions and morals, to observe the accounting and auditing standards approved in the State and not to reveal the secrets of my customers or any information entrusted to me due to my work, unless within the extent required by the laws and regulations in force'".

47. The "State" is the UAE. I note that the accounting and auditing standards approved by the State include those referred to in the Ministerial Decision No 403/2015: see paragraph 32 above.

48. Under Article 30, an auditor who "breaches his duties in practising his profession, acts in a way of demeaning the same, commits any of the prohibitions set forth in this Law, regulation or decisions issued in implementation thereof, or commits a violation of the rules of the profession, the accounting standards or principles, the governance controls and institutional disciplinary standards in force at [the UAE]" may be subject to disciplinary standards by way of a warning, a fine, suspension from practice or removal of his registration.

49. Article 40 of the 2014 Auditors Law provides (under a heading "Crimes where Reconciliation is not possible") as follows:

"Shall be punished by imprisonment for a period of not less than one year and a fine not less that (AED200,0000) two hundred thousand Dirhams and not exceeding (AED2,000,00) two million Dirhams or by one of these penalties: ...

4. Whoever reveals the secrets of the company or establishment being audited by him".

50. The scope of Article 40(4) is, on its face, narrower than undertakings given pursuant to Article 12 in that it is concerned only with secrets of the company or other entity being audited, and it does not extend to "any information entrusted to [the auditor] due to [the audit] work".

51. In the Paragraph 20 Notices, EYME relied on Article 12(1) and Article 40. Clyde & Co, writing on its behalf, said that, by reason of Article 12, "EYME (and any registered auditor it employs) is prohibited from producing any documents which either contain 'the secrets of [its] customers (in this case the NMC Group) or 'any information entrusted to [it] due to its work', in circumstances where for the purposes of the UAE law, it is not required to do so by onshore UAE laws and regulations". By the end of the hearing, however, EYME had accepted that the undertakings required by Article 12 are not given by accounting or auditing firms but by individuals authorised to undertake auditing work. According to the evidence of Mr O'Sullivan, auditors are required to give such an undertaking to the UAE Ministry of Economy before being registered as auditors and it is binding on them as long as they practise in the UAE. EYME has not itself given an undertaking to the Ministry, and it would not itself be in a breach of an undertaking were it to comply with an order to produce documents. Further, Mr Brocklebank accepted that a breach of an undertaking would not attract penal sanctions: EYME's case is based on the risk that individual auditors would face the risk of regulatory sanctions. and it was submitted that it has a proper interest in protecting its employees from being breach of undertakings that they have given.

52. It might be said that this in itself means that the EYME's argument based on the undertaking should be rejected: that paragraph 20 of the February Order is engaged only when EYME is at risk of being in contravention of a law. However, the JAs did not take this point, which would not in any case answer EYME's argument based on Article 40. They had other answers to the argument about the undertakings.

53. First, the JAs submitted that it cannot have been the intention of the legislature that "an audit firm can or should withhold from its own client confidential information belonging to that client or any information entrusted to the audit firm acting on behalf of its client". I observe that the only former clients of EYME for whom the JAs are acting are NMCH and Holding, although most of the other companies whose documents are sought have consented to production to the JAs. Leaving that aside, on any view the JAs' submission is not a complete answer to EYME's argument: it does not cover documents about the entities, such as Cooper Healthcare LLC and Trans Arabia Drug Store LLC, which have not given their consent to disclosure to the JAs; it does not answer concerns about information that EYME was given in the course of its audits by third parties, such as banks or counter-parties with whom the NMC companies had transactions; nor does it answer concerns about information about third parties, such as patients of healthcare facilities, to which EYME was made privy in the course of audit or other work.

54. The JAs also relied on the exception in respect of matters "within the extent required by the laws and regulations in force". They submitted that this would apply if EYME produced documents pursuant to an order of this Court. Mr Brocklebank responded with three arguments: (i); that the exception refers only to laws or regulations of the "ordinary" UAE jurisdiction, and not to laws or regulations of the ADGM; (ii) that it applies only where there is a law or regulation that covers the conduct of the auditor, and a Court order does not suffice; and (iii) it applies only to what is "required" by a law or regulation. The undertakings and their interpretation were clearly governed by, and are to be interpreted according to, the law of the UAE and these arguments raise issues of interpretation of the undertakings (rather than statutory interpretation). Neither party suggested that the principles of interpretation under UAE law differ materially from those of the law of England, or, therefore, of the ADGM. I shall take these points in reverse order.

55. Mr Brocklebank emphasised that the exception applies only to the extent "required" by a law or regulation, and not, he contended, where the Court makes an order in the exercise of its discretion (such as an order under section 256 of the Insolvency Regulations). I cannot accept that argument: I see no reason that the undertaking should allow production of documents if a statute required production but not if a Court exercised as discretion to an order made under a statute, and the language of the undertaking does not demand it. To my mind, the exception is concerned with the position where a law or regulation (expressly or impliedly) requires, or demands, an exception in order to have its intended effect.

56. The exception refers to a law or regulation requiring an exception. Does that language cover the position where production is required under an order made pursuant to a law or regulation? In my judgment, as a matter of ordinary language, it does. If an order is made pursuant to a statute, it is natural to refer to the obligation that it creates as resulting from or being required by the statute. Further, as I have said, EYME has accepted that an order of the ADJD Court, or recognition by an ADJD Court of an order of this Court, would be sufficient to allow it to produce documents: see paragraph 44 above.

57. Nor am I impressed by Mr Brocklebank's third argument. The exception covers what is required by regulations, and I cannot suppose that does not include regulations made under an Abu Dhabi Law by a body authorised to do so. The Insolvency Regulations are just that.

58. However, the JAs' have a more fundamental point. They argue that the phrase in the carve-out "laws and regulations in force" refers to the laws and regulations in force from time to time when the conduct in question takes place Mr Brocklebank despite this, and I accept that step in the JAs' argument.

59. The 2014 Auditors Law was repealed by the 2023 Auditors Law, which came into effect on 29 March 2024. Article 39 of the Auditors Law 2023 provides that Auditors Law 2014 is repealed together with "any provision that violates or contradicts the provisions of this Decree-Law". Article 39(2) provides as follows: "The regulations and decisions issued in implementation of [the 2014 Auditors Law] regarding regulating the profession of auditors shall continue to be implemented until the necessary regulations and decisions are issued to implement the provisions of this Decree-Law in a manner that shall not conflict with its provisions".

60. This in itself answers the EYME's argument on the basis of Article 40. What of their argument about Article 12? Mr Brocklebank argued that the repeal of the 2014 law does not mean that the undertakings given under article 12 are no longer in force. I did not understand Mr Beswetherick to suggest otherwise: his argument is that the repeal of the 2014 Auditors Law and its replacement with the 2023 Auditors Law affects the scope and application of the carve-out, and I accept it. It would be absurd for it to refer to the laws and regulations in force when the particular undertaking was given: that would mean that different rules would apply to different accountants depending on when they were registered as auditors. This leads to the question whether the 2023 Auditors Law permits EYME to produce document responsive to the February Order.

61. Article 18 of the 2023 Auditors Law provides as follows:

"The accounting firm and the chartered accountant may not disclose the secrets of the establishment of which the charted accountant become aware as a result of professional practice thereof, except in the following cases:

1. Based on the request or content of the establishment;

2. Pursuant to an order from a judicial authority or an official investigative authority;

3. Upon a request from the Ministry;

4. If the purpose of to prevent the occurrence of a crime or to report it, in such case, the disclosure shall only be to the official competent authority;

5. If the purpose is to defend itself before an investigative authority or any judicial authority and according to the needs of the defence".

(I have cited the translation included in the file of authorities agreed for the hearing. Clyde & Co cited a different translation in the Paragraph 20 Notices, but it was not suggested that the differences are significant).

62. Article 20 of the 2023 Auditors Law provides for sanctions for (inter alia) violation of article 18 by way of a warning, a fine or suspension or revocation of practising certificates. Article 28 provides for criminal sanctions for (inter alia) "Disclosing the secrets of the establishment acquired thereby while practising the profession or because of it". The JAs submitted that Article 28 cannot apply where disclosure is made in accordance with one of the exceptions set out in Article 18, and EYME did not suggest otherwise.

63. Mr Beswetherick therefore argued that, if EYME produces documents that this Court has ordered it to produce, neither it nor chartered accountants who work for it would be in breach of Article 18 because production would be made pursuant to "an order from a judicial authority". Further, he argued that, in those circumstances, persons who have given an undertaking under Article 12 of the 2014 Auditors Law would not be in breach of their undertakings because the disclosure by EYME is in accordance with the law now in force.

64. EYME responded that the ADGM Courts are not a "judicial authority" within the meaning of Article 18. I cannot accept that, largely for the reasons explained in paragraph 45 above. I also observe that it would be strange to give the term "judicial authority" different meanings in exception 2 and exception 5 in Article 18, and EYME's restrictive interpretation of the term "judicial authority" would lead to the curious result that exception 5 would not allow EYME to defend itself if proceedings were brought against it in the ADGM Courts. (EYME does, as I have said, have an office in the ADGM.)

65. Mr Brocklebank sought to support EYME's position by submitting that the second exception in Article 18 must be impliedly restricted in its application because it cannot be intended to cover orders of foreign courts. I am not entirely persuaded of that: it again would seem to me curious if EYME were unable to defend itself in proceedings brought before foreign "judicial authorities"; and if exception 4 were given a comparably limited application, EYME would be unable to present or report crime in foreign countries by communicating information to the appropriate authorities there. However that might be and assuming (without deciding) that exception 2 in Article 18 does not apply where an order is made by a foreign court, I would still conclude that the exception applies where there is an order of the ADGM Court: an implied exception of this kind is to be confined to what the rationale for the exception requires. This is consistent with the principles of interpretation to which Dr Hussain drew my attention: see para 30 above.

66. I therefore conclude that, if EYME discloses information or produces documents under and in accordance with an order of this Court, neither it nor any of its employees would contravene either the 2014 Auditors Law or any undertaking given under Article 12 of the 2014 Auditors Law or the 2023 Auditors Law.

The Penal Code

67. Next, EYME contends that production of documents covered by the February Order would put it, and its employees, in breach of article 432 of the Penal Code and therefore at risk of penal sanctions. Article 432 provides as follows:

"Any person who by virtue of his profession, occupation, status or specialization has access to a secret but discloses such secret in other than the cases permitted by Law, or who uses such secret for his own benefit or the benefit of another person, unless such disclosure or use is authorised by the concerned person, shall be liable to a jail sentence for a period not less than one (1) year and a fine not less than AED twenty thousand (20,000) or either one of these two penalties...".

68. Article 432 is concerned with "secrets". The term is not defined, and EYME was not able to provide a satisfactory formulation as to the scope of the term. The suggestion that it means what is "known to some people but not to others" is clearly too broad: much in the public domain is not known by everyone. But, whatever the precise scope of the term "secret", I do not understand the JAs to dispute that some of the documents of which they seek production would contain "secrets" within the meaning of the section. The JAs' arguments are similar to those that they advanced about the 2014 Auditors Law.

69. First, they referred to the exception where the disclosure or use is authorised by the "concerned person". I do not consider that an adequate response, for the reasons explained at paragraph 53 above.

70. Secondly, they submitted that disclosure, if ordered by this Court, is covered by the exception of "cases permitted by Law", since it is permitted by article 18 of the 2023 Auditors Law. I accept that submission, and therefore reject EYME's argument based on the Penal Code.

The Commercial Companies Law

71. I come to the Commercial Companies Law. Article 249 provides, "The auditor shall keep confidential all Company information that comes into his possession in the course of performing his responsibilities for the Company. The auditor shall not disclose such information to third parties or to the shareholders other than during the General Assembly, failing which the auditor shall be dismissed, without prejudice to the civil and criminal liability".

72. Contravention of Article 249 does not attract a penal sanction. Article 362 contemplates administrative penalties by way of fines for contravention.

73. Article 249 appears in a chapter of the Commercial Companies Law that is concerned with auditors of Public Joint Stock Companies, but article 104 provides that, unless otherwise provided, the provisions about Joint Public Stock Companies apply to a Limited Liability Company "to the extent that they are consistent with its nature". The JAs did not dispute that it applies to the companies with which this case is concerned, apart from NMC plc. By the end of the hearing, the application of the Commercial Companies Law to NMC plc (being an English company) was far from clear, but this question does not affect my decision, and I say no more about it.

74. The Commercial Companies Law does not include any express exceptions to the general prohibition in article 249. On its face and interpreted literally, it would have peculiarly wide application: for example, it would prevent an auditor discussing any "Company information" with directors or others in the course of and for the purpose of the audit. The legislator cannot have intended this: the purpose of the Law is stated at article 2 to be "to contribute to the development of the business environment and capacities of the [UAE] and its economic standing by way of regulating the companies in accordance with the global variables, especially those related to the regulation of governance rules, the protection of the interests of shareholders and partners, boosting foreign investment flow and the promotion of corporate social responsibility". Mr Brocklebank accepted that the scope of article 249 is subject to an implied exception to the extent required by article 248 and to allow the auditor to conduct the audit in accordance with his duties. Equally, it cannot have been intended that an auditor cannot use information to defend himself against proceedings brought against him in respect of his audit, or to prevent and report crime. In my judgment, it must be understood to be qualified to permit disclosure in accordance with Article 18 of the 2023 Auditors Law: see paragraph 31 above.

75. I reject the JAs' argument based on the Commercial Companies Law.

The Healthcare ICT Law

76. The last of the statutes on which EYME relies to argue that it should not produce documents (as opposed to its argument that it should be permitted to redact documents to satisfy the requirements of the Data Protection Law, which I shall consider separately) is the Healthcare ICT Law. It applies to "all Information and Communication Technology (ICT) methods and usages in the health fields within the [UAE], including Free Zones" (article 2), and requires that, when a person uses ICT in health fields, all health data and information is to be kept confidential and their circulation allowed only in permitted cases (article 4(1)). The purpose of the law is, inter alia, to ensure the "optimal use of ICT in the health fields" and to "ensure the safety and security of health data and information" (articles 3(1) and 3(4) respectively).

77. Article 13 provides that health information and health data relating to health services provided in the UAE may only be stored, generated or transferred outside the UAE "in the cases prescribed by virtue of a decision issued by the Health Authority in coordination of the Ministry". Article 24 provides that contravention of article 13 is punishable with a fine.

78. Article 16 provides as follows:

"Without prejudice to any legislation in force, whoever circulates information related to patients shall keep them confidential and shall abstain from using them for non-health purposes without obtaining the written approval of the patient and except in the following cases:

(1) The health information or data required by the health insurance companies or any health services funding entity with regard to the health services received by the patient, for the purposes of auditing, approving or verifying the financial benefits related to those services.

(2) Scientific and clinical research purposes, provided that the identity of patients is not disclosed and that the ethics and rules of scientific research are respected.

(3) Taking preventive and curative measures related to the public health or protecting the health and safety of the patient or any other person related to him.

(4) Upon request of the competent judicial entities.

(5) Upon request of the Health Authority for the purposes of control, inspection and protection of public health".

79. EYME accepts that the Healthcare ICT Law applies only to the Health Authority and Competent Entities (as defined), and that its wording does not apply directly to EYME. It argues, however, that it would be anomalous if EYME, being in possession of confidential data about patients, is not obliged to protect information covered by the Health ICT Law.

80. I cannot accept EYME's argument. First, there is no scope in the ordinary and natural meaning of the statute or under article 1 of the Civil Code to expand the application of the law beyond the Health Authority and the Competent Entities, to whose role, engagement with the Ministry of Health and Prevention, and duties the Law's articles consistently refer.

81. Secondly, article 16(4) excepts (inter alia) from the requirement to keep information confidential and not to use it for "non-health purposes" inter alia, disclosure or use requested by "the competent judicial entities". I reject EYME's argument that this Court is not a "competent judicial entity" for the reasons that I have already explained. I add that the position is the clearer here because the Healthcare ICT Law expressly applies to the Free Zones, including the ADGM.

82. I therefore reject EYME's argument based on the Healthcare ICT Law.

Conclusions about EYME's arguments that documents should not be disclosed

83. I conclude with regard to the New Argument that EYME would not be in breach of the 2014 Auditors Law, the 2023 Auditors Law, the Penal Law or the Healthcare ICT Law if it produces documents to the JAs pursuant to this Court's order, subject to the question whether it should redact them (which I consider below). In my judgment, the New Argument does not apply to the suggested contravention of the Commercial Companies Law because it does not attract penal sanctions, but even if I am wrong about that, I would similarly conclude that EYME would not be in breach of it.

84. As for the Bank Mellat Argument, I do not consider that there is a realistic risk that EYME would be in breach of the laws on which it relies. I also consider it unrealistic to think that, if it acted in accordance with and in order to comply with an order of this Court, EYME (or any of its employees) would be at risk of facing penal or regulatory proceedings, still less of being subjected to penal or regulatory sanction. There is no real risk to EYME, therefore. to balance against the importance to the JAs that the documents be produced.

The Data Protection Law and redaction of documents

85. The question whether EYME should be permitted to redact documents to remove personal information before producing them to the JAs falls into two parts: (i) whether the Data Protection Law requires that it should do so; and (ii) if not, whether EYME should be permitted by Court order to do so. I shall consider next the Data Protection Law. It is convenient to deal with the second point in the context of the Extension Application.

86. Article 7(1) of the Data Protection Law provides that a "Controller" (and it is not disputed that EYME is within the definition of Controller) shall "take the appropriate technical and organizational measures and procedures to apply the necessary standards to protect and secure Personal Data, in order to maintain its confidentiality and privacy and to ensure that it is not infringed, damaged, altered or tampered with, taking into account the nature, scope and purposes of Processing and the potential risks to the confidentiality and privacy of the Personal Data of the Data Subject". The term "processing" includes collecting, storing, sharing and disclosing data. "Personal Data" is widely defined: it is "Any data relating to an identified natural person, or one who can be identified directly or indirectly by way of linking data, using identifiers such as name, voice, picture, identification number, online identifier, geographic location, or one or more special features that express the physical, psychological, economic, cultural or social identity of such person. It also includes Sensitive Personal Data and Biometric Data". "Sensitive Personal Data" is defined as "Any data that directly or indirectly reveals a natural person's family, racial origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, or any data related to the health of such person, such as his/her physical, psychological, mental, genetic or sexual condition, including information related to health care services provided thereto that reveals his/her health status". Article 9 requires a Controller to self-report to the UAE Data Bureau if it becomes aware of any breach of the Law that would compromise the privacy, confidentiality or security of Personal Data. Article 26 provides for administrative penalties for breach of the Law.

87. Mr Brocklebank also referred to Article 7(2), which contemplates that the Controller might comply with the requirements of the Data Protection Law through (as it has been translated) "the Pseudonymisation Method", that is by dealing with Personal Data so as to make it impossible to associate the data with its subject without additional information that is kept separately and securely.

88. As the Paragraph 20 Notices explain, documents that are subject to the February Order contain Personal Data, including Sensitive Personal Data about patients of medical facilities provided by the NMC Group, such as their names, dates of birth, addresses and identification documents numbers, personal information about employees of both EYME and the NMC Group, including names, contact information and passport details; and similar information about the employees of third parties.

89. In response to EYME's case about the Data Protection Law, the JAs argued that EYME and NMC Group employees "must presumably have previously consented to the use of their personal data for the purposes of their employment contract". I am not persuaded by that point: under Article 1 of the Data Protection Law, a "Data Subject" consents to his Personal Data being processed only if consent is given "in a specific, clear and unambiguous manner" and through a "clear positive statement or action". There is no basis to infer that employees have given such consent. In any case, this point does not apply to patients and other third parties about whose data EYME has raised concerns.

90. The JAs' stronger argument is that Article 4 provides for exceptions to the prohibition on processing Personal Data including:

a. "If the processing is necessary to protect the public interest": Article 4(1);

b. "If the processing is necessary to initiate any proceedings of legal claim or defense of rights or is related to judicial or security procedures": Article 4(3); and

c. "If the processing is necessary to fulfil specific obligations stipulated in other laws in force in the [UAE] for the Controller": Article 4(10)

91. I do not propose to address the JAs' arguments based on Articles 4(1) and 4(10) because I accept that the exception in Article 4(3) applies: if this Court ordered production, the processing would be "related to judicial procedures". I understand Mr Brocklebank to have accepted that the exception would apply if EYME "processed" the documents in compliance with an order of the ADJD Courts. For the reasons that I have explained when considering comparable issues about the interpretation of other laws, I consider that the exception also extends to "processing" in compliance with an order of this Court. I add only this: the first limb of Article 4(3) would, in my judgment, allow EYME to defend proceedings brought against it not only in the ADJD Courts but also in this Court, and for this reason too it would be odd to interpret the second limb as confined to judicial procedures in the ADJD.

92. I therefore conclude that EYME would not be in breach of the Data Protection Law if it disclosed unredacted documents in accordance with an order of this Court. That said, when deciding whether the order of this Court should require or permit redactions, it is important for the Court to have in mind the purpose and policy reflected in the Data Protection Law. As Gross LJ observed in the Bank Mellat case (loc cit at para 63(v)), "should inspection be ordered, this Court can fashion the order to reduce or minimise the concerns under the foreign law by, for example, imposing confidentiality restrictions in respect of the documents inspected", and similarly redactions can, and should, be considered when the terms of any order are determined.

The Extension Application: Introduction

93. By the Extension Application, EYME sought to extend the times for production of documents pursuant to the February Oder as follows:

a. To extend the time for disclosure of documents in categories 1, 2 and 3(1) to 30 August 2024;

b. To extend the time for disclosure of documents in categories 3(2) and 5 to 31 October 2024;

c. To extend the time for disclosure of documents in categories 3(3) and 4 to 29 November 2024; and

d. To extend the time for disclosure of document in category 3(4) to 31 January 2025.

94. By a letter dated 30 August 2024 from Clyde & Co, EYME said that it had produced the majority of documents in Categories 1 and 2, and that it would be ready to complete production of these categories within the next week. As for other documents, it said that, while it had been "doing its utmost to diligently comply with the [February] Order and to provide all documents which are responsive", additional documents having been discovered, it estimated that it would require yet later deadlines:

a. Until 31 October 2024 to produce documents in category 3(1);

b. Until 29 November 2023 to produce documents in category 3(2);

c. Until 15 January 2025 to produce documents in category 3(3);

d. Until 31 January 2025 to produce documents in category 3(4)

e. Until 15 January 2025 to produce documents in category 4; and

f. Until 29 November 2024 to produce documents in category 5.

It emphasised that these revised dates were no more than estimates "based on the Production Team's experience over the last few months conducting this process and facing the challenges [that it had described]".

95. EYME has explained that the extra time is required for several reasons, including what are described as "unavoidable technical difficulties in carrying out the exercise", which I understand to mean or include computer-related problems, and simply the volume quantity of responsive documents. It is not necessary in this judgment to describe in detail the evidence about this: however, one reason for the delay in producing documents is to allow time for EYME to review the documents for Personal Data and privilege, and to make what EYME considers to be proper reactions.

96. At the hearing, Mr Robinson explained the up-to-date position as follows: that all the documents in categories 1 and 2 had been produced, and that (subject to my decision on the Foreign Law Application) EYME could produce in "very short order" the documents in category 3(1) apart from 37 documents or files. The 37 documents or files are presenting special problems either because they are in foreign languages; or because of technical issues in opening Excel spreadsheets; or because EYMW considers that a further review is required to determine whether they are responsive to the February Order. As for the other documents (in categories 3(2), 3(3), 3(4), 3(5), 4 and 5), EYME proposes, although it stands by its estimate that it will need until the dates in the letter of 30 August 2024 to complete their review and production, that it produce monthly tranches of the documents in the meanwhile.

The Extension Application: jurisdiction

97. In response to the Extension Application, the JAs submitted that the Court has no jurisdiction to entertain it. They argued that under the Practice Direction 14 (Insolvency) the ADGM Court may vary an order only in specified circumstances, and the Extension Application does not fall within the scope of the power. Paragraph 14.122 of the Practice Direction provides as follows:

"The Court may review, rescind, or vary any order made by it in relation to Insolvency Proceedings arising out of: (a) a change of circumstances; or (b) such other matter where the Court considers it is in the interests of justice to conduct such review or rescind or vary an order; however, this paragraph shall not apply in circumstances where the application constitutes an appeal of an order".

98. I observe at the outset, that this argument does not affect the position with regard to the disclosure of documents which have been withheld in according with paragraph 20 of the February Order. They are not being produced under the February Order (either varied or otherwise) but under the separate order that paragraph 20 of the February Order contemplated might be made and which the JAs sought in the Foreign Law Application.

99. In any case, I cannot accept the JAs' submission. Indeed, it is surprising that they advance it. At a hearing on 23 January 2024 about matters consequential upon the December 2023 and the terms of the order to reflect it, EYME submitted that the order should include "liberty to apply" in general terms in view of the length and complexity of the production required and because it might be necessary "to seek the Court's guidance and/or to vary the order, assuming variations cannot be agreed". The JAs did not suggest that a provision in the February Order giving the parties liberty to apply would not achieve this purpose, and the February Order provided for "liberty to apply" in general terms.

100. However that might be, I reject the JAs' submission about jurisdiction. First, it seems to me that the Extension Application is covered by the provision that the parties have liberty to apply. It is made because directions are required to "work out" how effect should be given to the February Order, inter alia in light of the Paragraph 20 Notices. As Rix LJ said in Tibbles v SIG plc [2012] EWCA Civ 518, "The revisiting of orders is commonplace where the judge includes a 'Liberty to apply' in his order. That is no doubt an express recognition of the possible need to revisit an order in an ongoing situation ...:". That observation was made in a case about variation of an interlocutory order, but it reflects what was said about a final order in Cristel v Cristel [1951] 1 KB 725, where Somervell LJ said, "Prima facie, 'Liberty to apply' is expressed ... where the order drawn up is one which requires working out and the working out involves matters on which it may be necessary to obtain a decision of the court. Prima facie, it does not entitle people to come and ask that the order itself be varied" (at p.728). I consider that questions about the timing of the production of documents arise because of what Rix LJ called the "ongoing situation" and the Extension Application falls comfortably under liberty to apply provision, as explained by Somervell LJ.

101. Even if the Extension Application does not fall under the liberty to apply provision, I also consider that it is permitted under PD 14.122. The paragraph must be interpreted with a view to securing that the Court is accessible, fair and efficient and that unnecessary disputes over procedural matter are discouraged (see the CPR r.2(3)), and to my mind this requires that PD14.122 be given a generous interpretation.

102. There have been several changes of circumstances that provide jurisdiction to entertain the Extension Application. Three short examples will suffice:

a. First, there have been technical issues in retrieving documents, as Mr O'Sullivan explains.

b. Secondly, EYME has discovered many more responsive documents than were contemplated when the February Order was made. It might be said that EYME ought to have made a more accurate assessment of the number of responsive documents at the hearing following the December judgment, but, even if that is so (and there is not material before me that would justify the suggestion), the discovery of more documents remains a change of circumstances.

c. Thirdly, there is now to be an order under paragraph 20 of the February Order, and I regard this as a material change of circumstances in that it is sensible to have orderly coordination between the documents disclosed as a result of the paragraph 20 order and other documents covered by the February Order.

103. I also consider that justice requires that the Court entertain the Extension Application and review the February Order on its merits, giving EYME more time to comply with it. if it sees fit. As I have said, EYME proceeded at the hearing on 23 January 2024 on the basis that the liberty to apply provision would permit this, and the JAs did not then suggest otherwise. In those circumstances, it would be unjust to deprive EYME of the opportunity to apply to vary the deadline for production of documents.

104. I conclude, therefore, that the Court has jurisdiction to entertain the Extension Application. I do not regard this as a case in which a variation is, in substance or reality, by way of an appeal from or challenge to the February Order, and the Extension Application is not an affront to the principle that there should be finality in litigation. Nor do I consider that my views are inconsistent with anything said in the judgment of Deputy ICC Judge Agnello QC in Re Paragon Offshore Plc [2020] EWHC 2740 (Ch), which the JAs cited.

Should EYME's application for an extension of time be granted?

105. The JAs submit that the Extension Application should be refused. In a witness statement in opposition to the Extension Application, Mr Christoper Parker of DLA Piper UK LLP, the JAs' solicitors, complained that EYME did not make the application promptly when it became apparent that it needed more time for disclosure, but the JAs rightly did not pursue this point in submissions. The thrust of their complaint is that EYME is producing documents too slowly because it is carrying out excessive reviews, including reviews for relevance and to redact personal data, and that EYME's evidence does not justify the orders sought. However, it appears from the evidence that the JAs accept that personal data of patients should be redacted, or at least did not resist EYME doing so: Mr Parker said this in a statement opposing the Foreign Law Application: "Subject to further information from EYME on this point, it is unlikely that the personal data of patients would be relevant to the Administrators' ongoing investigation and therefore EYME's concerns should be capable of being addressed by appropriate redactions provided the underlying financial information is retained".

106. In their submissions on the Extension Application, however, the JAs criticised EYME's procedure for redacting documents for two reasons: first, it was said to be delaying the production of documents and that the Court should "direct that redactions are not to be applied/ be removed". Secondly, the JAs complained that EYME is making unjustified redactions. I see the force of the complaints about delay and excessive redaction: as for the latter, Mr Beswetherick put before the Court copies of engagement letters sent by EYME to NMCH for countersignature. EYME produced them pursuant to the February Order only after redacting the names of the persons who signed them for NMCH and EYME, and also, curiously, the name of one of the companies that was to be audited by EYME.

107. I am not persuaded, however, that I should refuse the Extension Application because of delay in compliance with the February Order or that I should direct EYME to produce documents without reviewing them and making proper redactions. As for Mr Beswetherick's suggestion that EYME should now be directed to repeat its review so as to remove unjustified redactions, this would likely delay further the production of documents, as well as aggravate the very considerable expense being incurred by EYME. Mr Parker rightly accepted that some information, notably personal data relating to patients, might properly be redacted: such redactions are proper not to protect EYME but to protect the interest of third parties in the confidentiality of their personal data. After all, there is the prospect that the documents and sensitive personal information might be disclosed outside the UAE for the purposes of the English proceedings. On the face of it, it would not be right to prejudice the interests of third parties because, it is said, EYME has not produced document with proper urgency.

108. I am not in a position to say more about what information might properly be redacted. It depends on an assessment of the potential importance to the JAs of having the information and balancing it against the interests of the third parties in its confidentiality. The usual procedure in such cases is for the party producing the documents to make that assessment, and for the recipient to challenge any redactions that it considers improper (assuming it considers the redacted information of sufficient interest to warrant a challenge).

109. Obviously, EYME should make every effort to comply with the February Order without undue delay, but the JAs have not put before the Court any specific evidence of a pressing need for them. Nor have they pursued the 2023 Application and its enforcement with great expedition. The determination of the 2023 Application was protracted, and to a significant extent this was because the JAs gave a wholly inadequate time estimate for the hearing required. More recently, they made their Foreign Law Application only on 12 June 2024, more than two months after the first Paragraph 20 Notice, and its timing on the eve of the scheduled hearing of the Extension Application led to it being adjourned.

110. To my mind, the proposal made by EYME to produce monthly instalments of documents is distinctly helpful. It is unfortunate that the JAs were not given notice of it before the hearing so as to give them a proper opportunity to consider their response. However that might be, in all the circumstances, I have concluded that the fairest and most practical response to the Extension Application is to put EYME's proposal to the test, and to see what documents are produced in the first two monthly instalments.

111. I shall therefore grant the Extension Application with regard to categories 1 and 2, and with regard to category 3(i), I shall extend the time for production to 31 October 2024, the extension sought in the letter of 30 August 2024. As for the remaining categories, I shall grant an extension until 8 November 2024. If EYME has produced a substantial part of the required disclosure by instalments in September and October 2024, it might be that the parties will reach an agreement about EYME fulfilling its remaining obligations under the February Order. Otherwise, EYME will have to apply for further extensions, and I would hope to be able to decide any such application without a further hearing. If, on the other hand, contrary to the spirit of Mr Robinson's proposal, EYME make little progress in September and October 2024, I would need a good deal of persuading that any further extension is justified and would consider endorsing the February Order with a penal notice.

112. I make no direction about redactions. EYME should not delay production by re-examining redactions where documents are ready to be produced and should continue to make such redactions as it sees fit, taking into account my ruling on the Data Protection Law. If the JAs challenge redactions and the parties cannot resolve the issue, the JAs should make such application to the Court as they see fit.

Conclusion

113. I therefore grant the Foreign Law Application, and I grant the Extension Application to the extent explained in paragraph 111 above.

114. I should be grateful if the JAs' representatives would draft and seek to agree with EYME's representatives an order giving effect to this Judgment.

115. Any application for costs should be made by 5.00 pm on 3 October 2024. I intend to resolve questions about costs without a hearing, unless there is good reason for one.

116. It remains only for me to thank all counsel for their helpful and interesting arguments. This was, I believe, the first time that this Court has received submissions from common law and UAE counsel acting together, and from my point of view, it resulted in a very satisfactory hearing.

Issued by:

Linda Fitz-Alan

Registrar, ADGM Courts
19 September 2024

	[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	Abu Dhabi Global Market judgments (Court of First Instance)
You are here: BAILII >> Databases >> Abu Dhabi Global Market judgments (Court of First Instance) >> NMC Healthcare Ltd & Ors v Neopharma LLC & Ors [2024] ADGMCFI 0013 (19 September 2024) URL: http://www.bailii.org/ae/cases/ADGMCFI/2024/13.html Cite as: [2024] ADGMCFI 0013, [2024] ADGMCFI 13

Abu Dhabi Global Market judgments (Court of First Instance)