University College Union v Persons Unknown

The Claimant, the University and College Union, is a trade union and professional association for staff working in further and higher education. It has more than 120,000 members across the United Kingdom.

The Claimant has reason to believe that it has the been the victim of a ransomware cyber attack, with information confidential to the Claimant, its employees, clients and/or associated third parties, being obtained from its computer or IT system between the dates of 12 and 16 August 2024. On 16 August 2024, a voicemail message was received by the Claimant coming from the Defendants, or someone acting on behalf of the Defendants, making the Claimant aware that they had access to the information. It was subsequently discovered that some of the information had been uploaded onto a website.

An urgent application for an interim injunction was made by the Claimant, without notice. This was heard by Richard Spearman KC, sitting as a deputy judge of the High Court on 16 October 2024. The deputy judge sat in private, but gave his reasons in public. The deputy judge ordered the interim injunction against “Person(s) Unknown responsible for obtaining data from the [Claimant’s] IT systems on or about 12 August 2024 to 16 August 2024 and/or who has disclosed or is intending or threatening to disclose the information thereby obtained”. The interim injunction required the Defendants, among other things, to deliver up and/or delete and/or destroy the information in their possession, custody and control, and provide to the Claimant’s solicitors a witness statement confirming that these steps had been taken.

The deputy judge also ordered service of the Claim Form and any other documents outside the jurisdiction if required, being satisfied that England and Wales was the proper place in which to bring the claim. The deputy judge also gave permission to the Claimant to make service by alternative means. The Order made by the deputy judge afforded the Defendants the opportunity to vary or discharge the Order. Subsequent to the making of the Order, there was no engagement by the Defendants with the proceedings.

On 14 November 2024, Hill J extended the injunction to trial, gave directions, and made an Order for alternative service as there were concerns that initial service had not been effective. The Order afforded the Defendants the opportunity to vary or discharge the Order. The directions included a requirement for the Defendants to serve a Defence to the Particulars of Claim by 4pm on 12 December 2024.

Hill J provided written reasons for her decisions on 22 November 2024: see [2024] EWHC 2998 (KB), these included a quotation from the deputy judge’s reasons that had been given orally in open court, based on a note from counsel rather than from a transcript. Hill J noted that the directions that she was making contemplated that if the Defendants continued to decline to engage with the proceedings, the Claimant would make an application for default judgment and/or summary judgment in the near future.

The Claimant now seeks a default judgment pursuant to CPR r.12.3(1) and a final injunction. The Claimant also seeks derogations from open justice to protect the case papers. The Claimant invited the Court to determine this matter without a hearing.

The Court has power to deal with an application on the papers without a hearing if the parties agree, or “if the court does not consider that a hearing would be appropriate”: see CPR r.23.8. I do not consider that a hearing would be appropriate in this particular case and will, therefore, determine the application without a hearing.

In taking this approach, I have regard to the analysis propounded by Warby J in Clarkson Plc v. Person(s) Unknown [2018] EWHC 417 (QB).

[7] It is unlikely that the Court could or would deal on the papers with an application for a final order that determines civil rights, if that way of proceeding was opposed by one of the parties. But there are cases like the present, where one party has failed to engage with the proceedings and has therefore expressed no view about the matter. It is not necessary to decide whether that involves a waiver of the party’s rights. I did not consider a hearing to be ‘appropriate’ in this case, because it would have added to the expense of this claim without serving any sufficiently useful purpose. On the facts of this case, and this application, the open justice principle can be properly respected and compliance with Article 6 [ECHR] achieved without the need for a hearing. That can be done by making the order and, through this judgment, publicising the fact it has been made and the basis for making it. Indeed, a process of this kind may even represent a more practical and effective way to give effect to the open justice principle and the Convention requirement for a public judgment, than holding a hearing.

[8] This is a claim brought against a Person or Persons Unknown and, as is quite common in such cases, the identity of the defendant(s) remains unknown. So, there is nobody defending the claim who could benefit from the advantages that a hearing often brings with it for the litigant. The case has not proceeded in secret. There have already been two public hearings, at each of which a public judgment has been given and recorded. Transcripts of those judgments are available as of right. There is little that has changed since the last hearing, at which I granted an interim order and gave a reasoned judgment explaining why. This is not a case in which there is any likelihood that a public hearing of this application would be more effective in bringing the attention of others to matters of importance than the method I am adopting. Rather the contrary. Transcripts are not created or published as a matter of course. They are not often applied for by third parties. This written judgment, by contrast, will be posted on a public website. The reality is that information about these proceedings will be more accessible, if the case is dealt with in this way, than it would be if the matter had been dealt with at a hearing”.

The same approach is called for in this case. The Defendants have not engaged with these proceedings, even though (as I will discuss further below) the Claimant has taken all practicable steps to notify the Defendants of this application and so the provisions of section 12(2) of the Human Rights Act 1998 are satisfied. I concur with what Hill J observed in her judgment at [15], “Given that the Defendant is an unidentified perpetrator of a cyber-attack, the clear inference is that [their non-engagement with the proceedings] is deliberate and that there is no intention of doing so”.

I also note, in this regard, that at earlier stages in the proceedings, judgments have been given in public, and this judgment will be made available to the public including by being posted on a public website. The effect of this is that appropriate information about this case will be accessible to the public. The only material that is not accessible is confidential material which was properly dealt with in private in any event by the deputy judge or is contained within confidential schedules that have been appropriately drafted. The public would not have had access to that material in any event even if the present application was considered at an oral hearing.

In considering this application for a default judgment, I have looked carefully at the relevant provisions of the CPR as well as the judgment of Collins Rice J in Armstrong Watson LLP v Person(s) Unknown [2023] EWHC 1761 (KB), where the essential principles were described. At [12] – [13] of that judgment, Collins Rice J stated that:

12.

According to CPR 12.3, the basic conditions to be satisfied for entering default judgment are that a claimant has duly filed and served a claim form and particulars of claim, the defendant has not filed acknowledgment of service or defence to the claim, and the time for doing so has expired.

13.

CPR 12.12(1) directs a court considering a default judgment application to ‘give such judgment as the claimant is entitled to on the statement of case’. I have directed myself to the guidance set out in Glenn v Kline [2020] EWHC 3182 (QB) at [24]-[27] as to the correct approach to applying this rule. Nicklin J said this:

[25] Although, under this rule, the Court must consider the judgment to which the claimant is entitled, the effect of default judgment is that the pleaded facts are treated as established. If those facts support the cause of action, the Court need go no further. The purpose of the requirement for an application is either to enable the court to tailor the precise relief, so that it is appropriate to the cause of action asserted, or otherwise to scrutinise the application in particular circumstances calling for more than a purely administrative response. Within these parameters, the Court must make an assessment of whether the applicant is entitled to the default judgment sought, or to some lesser or different default judgment: Football Dataco Ltd -v-Smoot Enterprises [2011] 1 WLR 1978 [16]-[19] per Briggs J.

[26] Evidence going to the merits is not required. The relief granted will normally be sought and granted on the basis of the claimant's statement of case.

That procedure is efficient and proportionate. Such a judgment is final and, to the extent it involves consideration of what relief is justified on the basis of the facts alleged in the statement of case, it does have an element of merits assessment: QRS -v- Beach [2015] 1 WLR 2701 [53] per Warby J.

Approved Judgment Armstrong Watson v Persons Unknown

[27] In Brett Wilson LLP -v- Person(s) Unknown [2016] 4 WLR 69, Warby J explained:

[18] The claimant's entitlement on such an application is to "such judgment as it appears to the court that the claimant is entitled to on his statement of case": CPR r 12.11(1) [CPR 12.12(1)]. I accept Mr Wilson's submission that I should interpret and apply those words in the same way as I did in Sloutsker -v- Romanova [2015] EWHC 2053 (QB) [84]:

"This rule enables the court to proceed on the basis of the claimant's unchallenged particulars of claim. There is no need to adduce evidence or for findings of fact to be made in cases where the defendant has not disputed the claimant's allegations. That in my judgment will normally be the right approach for the court to take. Examination of the merits will usually involve unnecessary expenditure of time and resources and hence [be] contrary to the overriding objective. It also runs the risk of needlessly complicating matters if an application is later made to set aside the default judgment: see QRS -v- Beach [2015] 1 WLR 2701 esp at [53]-[56]."

[19] As I said in the same judgment at para 86:"the general approach outlined above could need modification in an appropriate case, for instance if the court concluded that the claimant's interpretation of the words complained of was wildly extravagant and impossible, or that the words were clearly not defamatory in their tendency."

Those instances of circumstances which might require departure from the general rule are not exhaustive, but only examples. I have considered whether there is any feature of the present case that might require me to consider evidence, rather than the claimant's pleaded case, verified by a statement of truth and uncontradicted by the defendants. I do not think there is any such feature. I have therefore proceeded on the basis of the pleaded case, both in my introductory description of the facts above, and in reaching the conclusion that the claimant has established its right to recover damages for libel, and to appropriate injunctions to ensure that the libel is not further published by the defendants”.

The Claim form and Particulars of Claim in this case make it clear that this is a breach of confidence case. The essential elements of a breach of confidence claim are pleaded:

The Particulars of Claim set out the allegations of fact in relation to each of these elements. They describe the identity and nature of the information, the circumstances in which it was obtained, and the fact of disclosure.

In these circumstances, it is clear to me that the cause of action for breach of confidence is made out, and the facts alleged are sufficient to support that cause of action.

I am also satisfied that the Defendants have not complied with the Order of Hill J as they have failed to file and serve a Defence to the Particulars of Claim by 4pm on 12 December 2024. Indeed, they have not filed and served a Defence at all, nor has there been any response to this application. This is in spite of the fact that the Claimant has, on the basis of the evidence presented to the Court, which I accept, complied with the service requirements mandated by the previous Orders. The Claim Form was served on the Defendants on 23 October 2024; and the Particulars of Claim were served on 6 November 2024. The Order of Hill J was served on the Defendants on 18 November 2024.

The Defendants have not indicated that they are outside the jurisdiction. Even if they are, the time limits for filing acknowledgment of service or Defence have long since expired.

Adam Speker KC and Ben Gallop, counsel for the Claimant, have correctly drawn my attention to the recent judgment of Nicklin J in Chirkunov v Person(s) Unknown [2024] EWHC 3177 (KB). In that case, the learned judge refused the claimant’s application for permission to serve out of the jurisdiction a claim form on defendant persons unknown.

In Chirkunov, Nicklin J looked carefully at CPR r.6.37(1), and in particular (1)(c) which states that an application for permission to serve outside of the jurisdiction requires the applicant to set out “the defendant’s address or, if not known, in what place the defendant is, or is likely, to be found”. On its face, therefore, there is a requirement at least to identify where the defendant is, or is likely to be, located. Nicklin J considered the question as to how that requirement can be satisfied if the claimant is seeking to serve against persons unknown and does not know where they reside or are likely to reside. Nicklin J analysed this matter in some detail but did not reach a conclusion that non-compliance with CPR r.6.37(1)(c), or a failure to identify where the defendant is or was likely to be found, was necessarily fatal to an application for service out of the jurisdiction: see [90]. Nicklin J’s observations about that rule are, therefore, obiter.

In the course of his judgment, Nicklin J pointed out that he had been referred to a number of cases in which the Court had granted permission to serve a claim form out of the jurisdiction where the location of the defendant was not known. This included an earlier judgment in the proceedings between Armstrong Watson LLP v Persons Unknown: see [2023] 4 WLR 1. Nicklin J observed at [87] that in none of those cases was any attention paid to CPR r.6.37(1)(c), and so they did not provide assistance in analysing the meaning and effect to be given to that part of the CPR.

Nicklin J also stated that:

“the circumstances in which these decisions came to be made – often urgent interim injunction applications where only one party was represented – mean that the fact that CPR 6.37(1)(c) was not considered is not altogether surprising. Many of the cases were instances where, wherever the defendant was located, the assessment of appropriate forum plainly favoured England & Wales. In several of the cases, the grant of permission to serve the Claim Form out of the jurisdiction was very much an insurance against a possibility that the defendant turned out not to be within the jurisdiction of the Court. Not all cases will be that straightforward.”

These circumstances also apply to the present case. The application to serve the claim form out of the jurisdiction was considered by the deputy judge at the same time as the Claimant’s application for an urgent injunction. The precise wording and effect of CPR 6.37(1)(c) does not appear to have been considered by the deputy judge. The application to serve out of the jurisdiction was an “insurance policy”, in case the Defendants did reside outside of England and Wales. Furthermore, the Claimant argued that England and Wales is the proper place in which to bring this claim given that it is based in England, and this appears to have been accepted by the deputy judge as it is mentioned in his Order, albeit not in the reasons that he gave for his decision. I note, in passing, that in Chirkunov, Nicklin J did not regard the proper place for considering the claimant’s claim for breach of his data protection rights as being in England Wales: see [82]. It was for this reason that the learned judge declined to exercise his discretion to permit service of the claim form out of the jurisdiction.

I do not need to decide at this stage of the proceedings whether non-compliance with CPR r.6.37(1)(c), or a failure to identify where the Defendants are or are likely to be found, should have been fatal to the Claimant’s application for service out of the jurisdiction. The Order granting that application has been made by the deputy judge, and the Defendants have not sought to set it aside or vary it. They can still do so if they engage with these proceedings.

I am persuaded, for the reasons given above, that the other elements for obtaining a default judgment are satisfied. Accordingly, I allow the Claimant’s application and grant default judgment against the Defendants.

I grant the application for a final injunction: (i) prohibiting the Defendants from using, publishing, communicating or disclosing the information; and (ii) ordering the Defendants to deliver up and/or delete and/or destroy the information, and to provide a witness statement with a statement of truth explaining their compliance.

The remedy of a final injunction is appropriate in this case, given that (i) default judgment has been granted; (ii) the Defendants have failed to engage with these proceedings and have not complied with the previous Orders; and (iii) there is, in my judgment, a high risk that unless restrained by, and subject to the terms of, a final injunction the Defendants will continue to breach the confidence that they owe to the Claimant.

I also make the Order sought by the Claimant which includes the payment of costs by the Defendants, the opportunity for the Defendants to apply to vary or discharge the order, and for there to be continuing supervision of the Court with respect to access and use of documents prepared for this litigation so as to protect the Claimant’s confidentiality. The latter order is strictly necessary to maintain the effectiveness of the relief that I am granting.