University College Union v Persons Unknown

Default judgment may be entered where the claim form and particulars of claim were duly served, the defendant failed to acknowledge service or serve a defence within time, and the pleaded facts establish a cause of action. The court ordinarily proceeds on the pleaded case without investigating the merits, subject to circumstances requiring closer scrutiny or different relief.

A final injunction is appropriate where default judgment establishes breach of confidence and there is a high risk of continuing misuse or disclosure. An application may be determined without a hearing where the defendant has not engaged, the court considers a hearing inappropriate, and open justice and Article 6 requirements remain satisfied.

The claimant, a trade union, alleged that persons unknown obtained confidential information from its IT systems during a ransomware attack and had disclosed, or threatened to disclose, that information.

An interim injunction was granted by a deputy High Court judge. The injunction was later extended to trial by Hill J, who also directed service and required a defence. The defendants did not engage with the proceedings or serve a defence.

The claimant sought default judgment, a final injunction, and orders protecting confidential case materials. The central issues were whether the application could properly be determined without a hearing, whether the conditions for default judgment were met, and whether final injunctive relief should be granted.

1. Determination without a hearing. The court may determine an application on paper under CPR rule 23.8 where the parties agree or the court considers a hearing inappropriate. In this case the defendants had not engaged despite practicable steps to notify them. Public judgments had been given at earlier stages, the present judgment would be publicly available, and confidential material would not have been accessible at an oral hearing. Open justice and Article 6 of the European Convention on Human Rights were therefore satisfied.
2. Default judgment. The requirements under CPR rule 12.3(1) were satisfied. The claim form and particulars of claim had been served, the time for acknowledgment of service and defence had expired, and no defence had been filed. Under CPR rule 12.12(1), the court ordinarily treats the pleaded facts as established and determines the judgment to which the claimant is entitled on the statement of case. Evidence on the merits is generally unnecessary, although the court may scrutinise the claim where the pleaded case is defective or the circumstances require a different approach.
3. Breach of confidence. The pleaded case identified confidential information, unauthorised acquisition, circumstances giving rise to a reasonable expectation of privacy or confidentiality, a duty of confidence, and obtaining, retaining, disclosing or threatening to disclose the information in breach of that duty. Those allegations were sufficient to establish the cause of action for the purposes of default judgment.
4. Service out. The court did not decide whether non-compliance with CPR rule 6.37(1)(c), or failure to identify where persons unknown were or were likely to be found, would have prevented service out of the jurisdiction. The earlier order permitting service remained effective because it had not been set aside or varied, while the defendants retained the opportunity to apply for such relief.
5. Relief. A final injunction was granted prohibiting use, publication, communication or disclosure of the information and requiring its delivery up, deletion or destruction, together with a witness statement confirming compliance. The relief was justified by default judgment, the defendants’ continuing non-engagement and non-compliance, and the high risk of further breaches. Costs, liberty to apply, and continuing court supervision of access to litigation documents were also ordered.