A judge has ordered the return of more than a decade's worth of unrelated material accidentally disclosed by a law firm to the opposing side.
London firm Forsters LLP, representing a couple involved in litigation with their neighbour Zia Uddin, mistakenly responded to his data subject access request by sending him thousands of emails wholly unrelated to the case.
It emerged that the data handed over had included all responses to the firm’s use of the search term ‘Uddin’, which picked up documents dating back to 2009 relating to clients with this name.
After Mr Uddin had refused to return the data, the firm applied to the court for an interim injunction in breach of confidence seeking delivery of all confidential and privileged documents disclosed by mistake.
Sitting in the High Court in Forsters LLP v Uddin, DHCJ Guy Vassall-Adams KC acknowledged this had been a ‘serious data breach’ and ruled that the material should be returned.
‘Notwithstanding that there is some confidential and privileged information that the defendant cannot un-know, so far as practicable, the court should strive to put the claimant back in the position that it would have been in had the obvious mistake not occurred,’ said the judge. ‘In practical terms this means that the defendant must deliver up all the 3,300 documents in his possession.’
The court heard that Uddin, subject to a claim for noise nuisance, had made the DSAR request asking for surveillance recordings of his property, audio files and expert reports.
He received a URL link for accessing the information from Forsters and wrote the following day to say the file contained a significant volume of emails wholly unrelated to the case. These documents involved third parties and former clients, and Uddin said it constituted a ‘severe and indefensible breach of your professional and statutory duties’.
The firm immediately responded to confirm that the wrong data file had been inadvertently sent and required Uddin immediately to permanently delete it in its entirety.
Uddin said this demand was ‘improper’ and that the disclosure was directly relevant to his own claims against the firm of harassment and data misuse. He informed Forsters he would preserve all evidence securely, pending judicial or regulatory intervention.
The judge said the starting point with disclosure that was an ‘obvious mistake’ was to intervene by injunction and rectify the error.
He added: ‘The defendant also has well over 2,000 confidential documents which are wholly unrelated to his case. There is no possible justification for the defendant to hold on to these, as he appeared to concede in his initial response [to the firm]. The claimant should be able to regain control of all of these documents on behalf of its clients whose personal data and confidential information has been compromised in this way.’
1 Reader's comment