In Kul and Others v DWF Law [2026] EWCA Civ 1130, the claimants sought damages resulting from road traffic accidents (RTAs). The defendants’ solicitors, DWF, used information about them in other personal injury litigation to support a contention that their claims were fundamentally dishonest. The claimants brought an action against DWF, claiming that such use infringed their data protection rights. Mrs Justice Eady dismissed those claims at trial and the matter came before the Court of Appeal.
The relevant statutory regime was contained in the Data Protection Act (DPA) 2018 and the UK General Data Protection Regulation (UK GDPR).
Lord Justice Warby described the background. A group of insurers suspected that they and their insured had been victims of a substantial number of fraudulent or dishonestly exaggerated RTA claims, which relied on bogus medical reports. In 43 claims of this kind (the disputed claims) brought in the county court by clients represented by Ersan Solicitors, the defendants had relied on the ‘fundamental dishonesty’ provisions in the qualified one-way costs shifting (QOCS) regime that applied to personal injury claims. If fundamental dishonesty was established in any of these cases, the claimants were likely to have their claim dismissed and/or to forfeit the costs protection afforded by the QOCS regime under CPR 44.16(1).
In support of their case of fundamental dishonesty, the insurers relied on a review of 372 RTA claims between 2016 and 2021. In 367 of those claims, Ersan represented the claimants. The review identified common themes and patterns that DWF said were capable, if substantiated, of supporting the allegations of dishonesty advanced in the disputed claims. A spreadsheet was prepared, listing cases with allegedly suspect features. The spreadsheet contained the names of the claimants in the cases reviewed and details of the medical claims advanced.
In 2021, a senior solicitor at DWF made a witness statement exhibiting the spreadsheet, which was served on Ersan in its capacity as solicitors for the claimants in the 43 disputed claims. Later, DWF offered to provide a revised version of the spreadsheet, replacing each claimant’s name with the Ersan reference number for that claimant. This offer was reflected in a court order covering all 43 disputed claims.
Applications were made to the court by Ersan in some of the disputed claims to debar DWF from relying, on behalf of its clients, on the spreadsheet. The court held that the spreadsheet contained admissible similar-fact evidence, and that issues of reliability would be for the trial judge. An appeal by the claimants against that decision was subsequently dismissed.
Ersan also raised complaints about the spreadsheet with the Information Commissioner’s Office (ICO). The ICO rejected these complaints, stating that no evidence had been identified that demonstrated DWF had breached the requirements of the data protection legislation.
In October 2023, Ersan filed in the High Court a Part 8 claim form on behalf of 127 of the individuals named in the original spreadsheet. The claims, brought against DWF, complained about the processing of the claimants’ personal data, including health information, in various RTA proceedings in breach of various articles of the UK GDPR.
However, 124 of those claims were subsequently abandoned altogether and discontinued, leaving just three claimants. Eady J said in her judgment that by the time of the hearing, the claimants’ arguments had crystallised down to the absence of pseudonymisation in the spreadsheet.
In relation to processing, DWF had only disclosed the full dataset to Ersan and the courts. Any wider circulation to other claimants had been carried out by Ersan. DWF was not the data controller in respect of that circulation.
In relation to lawfulness, DWF had established that pursuant to the UK GDPR, the relevant processing was undertaken in compliance with its obligation to act on its clients’ instructions and in their best interests, that it was thereby acting in the public interest in ensuring the proper administration of justice and that the processing was for the clients’ legitimate interests.
In relation to questions of necessity and proportionality, case law established a threefold test. The court would need to be satisfied not only: (i) that the controller was indeed pursuing a legitimate interest; and (ii) that the personal data was processed for that purpose; but also (iii) that the interests or fundamental freedoms of the data subject did not take precedence over that legitimate interest, something that would require consideration of the reasonable expectations of the data subject as well as the scale of the processing and its impact on that person.
Applying these principles, Eady J accepted the evidence from DWF as to the need to use names in the first instance because of how its systems worked.
Eady J further held that the relevant processing was proportionate and that the legitimate interests pursued by the insurers were not outweighed by the interests and fundamental rights and freedoms of the claimants. They had provided the information with a view to litigation, and could reasonably expect it to be scrutinised, analysed, used and disclosed by opposing lawyers and to be disclosed in open court. The data were relevant. DWF relied on the spreadsheet to support the plea of fundamental dishonesty. Whatever the claimants might say about the spreadsheet’s limited evidential value, it had been held admissible for that purpose.
In the Court of Appeal, Warby LJ commented that the data protection claims advanced in this action had fluctuated and mutated. By the end of the appeal hearing, the only contention being advanced was that Eady J had erred by failing to find a risk that DWF would process their personal data in the form of a version of the spreadsheet that was not pseudonymised. Warby J said this was a new case, which he could not entertain now, applying the relevant principles. Therefore, the appeal would be dismissed.
Malcolm Johnson is head of abuse claims at Lime Solicitors, London
No comments yet