University College Union v Persons Unknown (REsponsible for Obtaining Data from the Claimant's it Systems on or About 12 August 2024 to 16 August 2024 and/or who has Disclosed or is Intending or Threatening to Disclose the Information Thereby Obtained)

Approved Judgment

This judgment was handed down remotely at 11.00am on 3 February 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

Introduction

The Claimant, the University and College Union, is a trade union and professional association for staff working in further and higher education. It has more than 120,000 members across the United Kingdom.

The Claimant has reason to believe that it has the been the victim of a ransomware cyber attack, with information confidential to the Claimant, its employees, clients and/or associated third parties, being obtained from its computer or IT system between the dates of 12 and 16 August 2024. On 16 August 2024, a voicemail message was received by the Claimant coming from the Defendants, or someone acting on behalf of the Defendants, making the Claimant aware that they had access to the information. It was subsequently discovered that some of the information had been uploaded onto a website.

An urgent application for an interim injunction was made by the Claimant, without notice. This was heard by Richard Spearman KC, sitting as a deputy judge of the High Court on 16 October 2024. The deputy judge sat in private, but gave his reasons in public. The deputy judge ordered the interim injunction against “Person(s) Unknown responsible for obtaining data from the [Claimant's] IT systems on or about 12 August 2024 to 16 August 2024 and/or who has disclosed or is intending or threatening to disclose the information thereby obtained”. The interim injunction required the Defendants, among other things, to deliver up and/or delete and/or destroy the information in their possession, custody and control, and provide to the Claimant's solicitors a witness statement confirming that these steps had been taken.

The deputy judge also ordered service of the Claim Form and any other documents outside the jurisdiction if required, being satisfied that England and Wales was the proper place in which to bring the claim. The deputy judge also gave permission to the Claimant to make service by alternative means. The Order made by the deputy judge afforded the Defendants the opportunity to vary or discharge the Order. Subsequent to the making of the Order, there was no engagement by the Defendants with the proceedings.

On 14 November 2024, Hill J extended the injunction to trial, gave directions, and made an Order for alternative service as there were concerns that initial service had not been effective. The Order afforded the Defendants the opportunity to vary or discharge the Order. The directions included a requirement for the Defendants to serve a Defence to the Particulars of Claim by 4pm on 12 December 2024.

Hill J provided written reasons for her decisions on 22 November 2024: see [2024] EWHC 2998 (KB), these included a quotation from the deputy judge's reasons that had been given orally in open court, based on a note from counsel rather than from a transcript. Hill J noted that the directions that she was making contemplated that if the Defendants continued to decline to engage with the proceedings, the Claimant would make an application for default judgment and/or summary judgment in the near future.

The Claimant now seeks a default judgment pursuant to CPR r.12.3(1) and a final injunction. The Claimant also seeks derogations from open justice to protect the case papers. The Claimant invited the Court to determine this matter without a hearing.

Determination without a hearing

The Court has power to deal with an application on the papers without a hearing if the parties agree, or “if the court does not consider that a hearing would be appropriate”: see CPR r.23.8. I do not consider that a hearing would be appropriate in this particular case and will, therefore, determine the application without a hearing.

In taking this approach, I have regard to the analysis propounded by Warby J in Clarkson Plc v. Person(s) Unknown [2018] EWHC 417 (QB).

[7] It is unlikely that the Court could or would deal on the papers with an application for a final order that determines civil rights, if that way of proceeding was opposed by one of the parties. But there are cases like the present, where one party has failed to engage with the proceedings and has therefore expressed no view about the matter. It is not necessary to decide whether that involves a waiver of the party's rights. I did not consider a hearing to be ‘appropriate’ in this case, because it would have added to the expense of this claim without serving any sufficiently useful purpose. On the facts of this case, and this application, the open justice principle can be properly respected and compliance with Article 6 [ECHR] achieved without the need for a hearing. That can be done by making the order and, through this judgment, publicising the fact it has been made and the basis for making it. Indeed, a process of this kind may even represent a more practical and effective way to give effect to the open justice principle and the Convention requirement for a public judgment, than holding a hearing.

[8] This is a claim brought against a Person or Persons Unknown and, as is quite common in such cases, the identity of the defendant(s) remains unknown. So, there is nobody defending the claim who could benefit from the advantages that a hearing often brings with it for the litigant. The case has not proceeded in secret. There have already been two public hearings, at each of which a public judgment has been given and recorded. Transcripts of those judgments are available as of right. There is little that has changed since the last hearing, at which I granted an interim order and gave a reasoned judgment explaining why. This is not a case in which there is any likelihood that a public hearing of this application would be more effective in bringing the attention of others to matters of importance than the method I am adopting. Rather the contrary. Transcripts are not created or published as a matter of course. They are not often applied for by third parties. This written judgment, by contrast, will be posted on a public website. The reality is that information about these proceedings will be more accessible, if the case is dealt with in this way, than it would be if the matter had been dealt with at a hearing”.

The same approach is called for in this case. The Defendants have not engaged with these proceedings, even though (as I will discuss further below) the Claimant has taken all practicable steps to notify the Defendants of this application and so the provisions of section 12(2) of the Human Rights Act 1998 are satisfied. I concur with what Hill J observed in her judgment at [15], “Given that the Defendant is an unidentified perpetrator of a cyber-attack, the clear inference is that [their non-engagement with the proceedings] is deliberate and that there is no intention of doing so”.

I also note, in this regard, that at earlier stages in the proceedings, judgments have been given in public, and this judgment will be made available to the public including by being posted on a public website. The effect of this is that appropriate information about this case will be accessible to the public. The only material that is not accessible is confidential material which was properly dealt with in private in any event by the deputy judge or is contained within confidential schedules that have been appropriately drafted. The public would not have had access to that material in any event even if the present application was considered at an oral hearing.

Default Judgment

In considering this application for a default judgment, I have looked carefully at the relevant provisions of the CPR as well as the judgment of Collins Rice J in Armstrong Watson LLP v Person(s) Unknown [2023] EWHC 1761 (KB), where the essential principles were described. At [12] – [13] of that judgment, Collins Rice J stated that:

12. According to CPR 12.3, the basic conditions to be satisfied for entering default judgment are that a claimant has duly filed and served a claim form and particulars of claim, the defendant has not filed acknowledgment of service or defence to the claim, and the time for doing so has expired.

13. CPR 12.12(1) directs a court considering a default judgment application to ‘give such judgment as the claimant is entitled to on the statement of case’....