HCE v UEH & Anor

Interim mandatory relief is available where there is a serious question to be tried, damages would not be adequate and the balance of convenience favours relief. The court must also have a high degree of assurance that the claimant will establish its case at trial. A person who intentionally obtains confidential information without authorisation may owe a duty of confidence. Examining and retaining confidential information may itself constitute a breach. Where exfiltrated information has no legitimate basis for retention, delivery up or destruction may be ordered. An alleged ethical or security-testing purpose does not justify continued possession. An order requiring an alleged wrongdoer to explain the method of exfiltration may be refused where it could compel self-incrimination.

The claimant, a technology company operating a discreet dating platform, sought an interim non-disclosure order against a registered user and his web development company. The claimant alleged that the first defendant had accessed its information systems without authorisation and exfiltrated substantial member and business data. The defendants did not attend the hearing, although the first defendant had offered limited undertakings and indicated that he might complain to the Information Commissioner’s Office.

The court considered whether interim mandatory relief should be granted, whether the information was confidential, whether damages were an adequate remedy, whether Convention rights affected the relief, and whether the claimant was entitled to an order requiring an explanation of the exfiltration method.

1. The application for interim relief was granted. The court applied the test in American Cyanamid Co. (No. 1) v Ethicon Ltd. [1975] AC 396: whether there was a serious question to be tried, whether damages were adequate and where the balance of convenience lay.
2. Because the claimant sought mandatory orders, the court also required a high degree of assurance that the claimant would establish its claim at trial, applying Zockoll Group Ltd. v Mercury Communications Ltd. [1998] FSR 354 at p 366. That enhanced test was satisfied.
3. The first defendant admitted accessing the claimant’s information without authorisation and had not agreed to return or delete it. The court considered it strongly arguable that obtaining, examining and retaining the information was unlawful and that the information was confidential to the claimant and, in some respects, its members.
4. A duty of confidence extends to a person who intentionally obtains confidential information without authorisation. Examining and retaining confidential documents may constitute a breach of confidence: Imerman v Tchenguiz [2012] Fam 116 at [36], [66]–[67].
5. Damages would not be an adequate remedy because the retained information had real value to the claimant and its members. The balance of convenience strongly favoured relief because the defendants had no legitimate basis to retain the information. Delivery up or destruction was therefore appropriate.
6. Article 10 of the Convention was not engaged because the first defendant had not said that he proposed to disclose the information. Section 12(3) of the Human Rights Act 1998 was consequently not engaged.
7. The court refused an order requiring an explanation of how the information had been exfiltrated. That was an unusual form of order and might require the first defendant to incriminate himself without further argument on its appropriateness.