HT-2021-000363 - [2025] EWHC 532 (TCC)

There is no dispute as to the underlying facts giving rise to this allegation. A potential customer of LzLabs used CPX with a specific scrub list to package up load modules and sent them to Winsopia. DR-4617 was opened on 21 January 2021, by which LzLabs requested Winsopia to carry out checks on the load modules to ensure that the redaction process had been performed correctly. When Winsopia analysed the files, it detected unscrubbed IBM CSECTs and endeavoured to remove them using CPX. Mr Whittingham explained in his evidence that when initially scrubbing for IBM material, CPX detected the “LZPDSE” component and assumed (wrongly) that it did not need scrubbing. This was discovered by Winsopia, the file was renamed and CPX effectively removed the IBM CSECTs. Further third-party confidential information was identified, the customer was required to modify its CPX processing steps and re-send the files to Winsopia.

The files containing unscrubbed materials were initially uploaded by Winsopia on the Winsopia LzLabs FTP Server, used to make CPX packages available to LzLabs. They were deleted when the issues were discovered. Subsequently, the fully scrubbed files were sent by Winsopia to LzLabs.

The issue is whether there is evidence that unscrubbed or insufficiently scrubbed load modules were sent by Winsopia to LzLabs. Mr Stephens’ evidence was that he had seen no evidence that any unscrubbed IBM modules, stubs or objects were sent to LzLabs. Although unscrubbed modules were placed on the FTP server, they were subsequently deleted and there is no evidence that the materials were accessed by LzLabs. Mr Swanson’s evidence was that it was unclear what was sent to LzLabs, although at least one CPX package was uploaded to the FTP server. In cross-examination, he agreed that Mr Stephens’ conclusion was a fair one.

On the limited evidence available, I find that the unscrubbed materials were uploaded initially to the FTP server but that they were deleted without LzLabs having access to them. On that basis, it could not be said that they were transferred out of Winsopia’s Enterprise.

It follows that IBM have not established any breach of the ICA in respect of this item.