PML v Person(s) Unknown

A person who obtains confidential documents by computer hacking is subject to an obligation of confidence. Where publication is threatened and the claimant is likely to establish that it should not be permitted, the court may continue an interim non-disclosure injunction.

In a blackmail case, privacy measures may be strictly necessary to prevent the proceedings from being frustrated. These may include a private hearing, claimant anonymity, restricted access to the court file and an order requiring an anonymous defendant to identify themselves. Permission for service out may be granted where the threatened publication and resulting detriment would occur in England and Wales.

The claimant company alleged that an unknown person had hacked its computer systems, taken a substantial quantity of data and demanded payment to prevent publication. The defendant continued to threaten disclosure after an initial without-notice injunction and appeared to have published some material through websites and an online forum.

Bryan J had granted an interim non-disclosure order, anonymity and related protective measures. On the return date, the claimant sought continuation of that order until trial, together with ancillary orders. The court considered continuing breach-of-confidence relief, private hearing and anonymity, self-identification by the defendant, and permission to serve proceedings outside the jurisdiction if required.

1. The application was granted. The interim non-disclosure order was continued until trial. There remained a real and continuing threat that the defendant would publish the stolen data unless paid. The apparent publication of some material and the failure to deliver up or delete it reinforced the need for continued relief.

2. The claimant was likely to establish at trial that publication should not be allowed. Information acquired through computer hacking carried an obligation of confidence. Applying Tchenguiz v Imerman [2011] Fam 116, the court held that the manner in which the defendant obtained the data was sufficient to impose that obligation. No public-interest justification for publication had been advanced.

3. A private hearing was strictly necessary under the Civil Procedure Rules 1998. The evidence concerned apparent blackmail, ongoing police investigations and stolen data. A public hearing would have frustrated, or at least harmed, the proceedings. The public judgment gave as full an explanation as possible and thereby mitigated the departure from open justice.

4. The claimant was properly kept anonymous as an apparent victim of blackmail. Restrictions on access to documents on the court file also remained necessary so that the injunction and anonymity order were not defeated. An anonymous defendant may be required to identify themselves and give an address for service where the claimant is likely to establish that publication should not be permitted and identification is needed to make eventual remedies effective.

5. Permission to serve the claim form and associated documents outside the jurisdiction was granted if necessary. The threatened breach of confidence would cause detriment in England and Wales, and the threatened act of publication would occur there. England and Wales was therefore the proper place to bring the claim. A direction also required the claimant to progress the action if no defence was filed, so that the interim injunction did not remain in place without final resolution.

High Court (Bryan J): On 21 March 2018, an interim without-notice non-disclosure injunction and related anonymity, privacy and protective orders were granted.

High Court (Nicklin J): On the return date, the court continued the injunction until trial and made further ancillary orders.