Yesim Kul & Ors v DWF Law LLP

Processing personal data disclosed in contemplated or actual litigation may lawfully extend to analysis across related claims where it is necessary and proportionate to establish, exercise or defend legal rights. Necessity means more than desirable but less than indispensable. The court must assess the purpose, available alternatives, the data subjects’ reasonable expectations, the scale and impact of processing, and safeguards such as pseudonymisation.

Fairness and transparency are distinct, cumulative requirements. Special category data may be processed where the conditions in article 9(2) UK GDPR are met. A later offer to pseudonymise data does not establish that earlier identifiable processing was unlawful, if names were initially necessary to ensure reliable identification and verification.

The claimants had brought or threatened personal injury claims against insurers represented by the defendant law firm. The defendant analysed data from hundreds of related claims in a spreadsheet known as JS1, including the claimants’ names and health information. It intended to rely on the analysis as similar-fact evidence in support of allegations of fundamental dishonesty in other County Court proceedings.

The claimants sought declarations and compliance orders under the UK GDPR. By trial, their principal complaint was that JS1 had not initially been pseudonymised. They alleged breaches concerning lawfulness, necessity, proportionality, fairness, transparency, purpose limitation, data minimisation, storage limitation, integrity and confidentiality, and the handling of special category data. The central issue was whether the defendant’s identifiable processing was lawful and proportionate.

1. The claims were dismissed. The defendant had processed the claimants’ personal data, including health data, without consent, but had established lawful purposes under article 6(1)(c), (e) and (f) UK GDPR. The processing supported the defendant’s professional obligations, the administration of justice and its clients’ legitimate interests.
2. Necessity means more than desirable but less than indispensable or absolutely necessary. It imports a proportionality assessment. For article 6(1)(f), the court must ask whether there was a legitimate interest, whether the processing was necessary for that interest, and whether the data subjects’ interests, rights or freedoms nevertheless took precedence.
3. The analysis of the wider group of claims was necessary and proportionate. At the initial stage, using names was required to distinguish multiple claimants arising from the same accident, avoid confusion between family members, maintain reliability and permit verification by the solicitors who already held the source information. Subsequent pseudonymisation did not make the original processing unlawful.
4. The claimants could reasonably expect information disclosed in contemplated litigation to be investigated, analysed and placed before the court in support of a defence. The defendant’s disclosure was limited to Ersan and the relevant courts. The defendant was not responsible for Ersan’s later disclosure to individual claimants.
5. Fairness and transparency required separate, cumulative assessment. The processing was not deceptive, caused no unjustified detriment, and had limited impact. Articles 14 and 17, and the corresponding protections in article 5, were subject to the legal-rights exemptions in Schedule 2 to the Data Protection Act 2018. The article 17 right to erasure did not apply because the processing was necessary for the defence of legal claims.
6. The health information fell within the article 9(2)(f) exception for processing necessary to establish, exercise or defend legal claims. The fact that one data subject had been a child did not alter the proportionality assessment. The claimants’ purpose-limitation, data-minimisation, storage-limitation, integrity and confidentiality complaints likewise failed.
7. The defendant’s abuse-of-process argument did not require determination because the substantive claims failed. No question of remedy arose; consequential matters, including costs, were left for written submissions.

Not an appeal. The judgment records earlier County Court proceedings and related High Court appeal decisions concerning the admissibility of JS1, but the present claims were independent UK GDPR proceedings.