Court of Appeal dismisses data protection appeal over solicitors’ use of claimant data

The Court of Appeal on 27 August 2026 dismissed an appeal by three road accident claimants who said defendant solicitors breached data protection law by using their details to allege fundamental dishonesty in other claims.

Background

The Court of Appeal (Civil Division), in [2026] EWCA Civ 1130, heard the appeal from Mrs Justice Eady's decision in [2025] EWHC 1824 (KB). Lord Justice Warby gave the judgment, with Lord Justice Newey and Lady Justice Asplin.

A group of insurers suspected that they and their insured had been the victims of fraudulent or dishonestly exaggerated road traffic accident injury claims. In 43 claims brought in the County Court by clients of Ersan Solicitors, the defence relied on the "fundamental dishonesty" provisions that sit alongside the qualified one-way costs shifting (QOCS) regime. If fundamental dishonesty is established, the claim is likely to be dismissed and costs protection may be lost.

DWF Law LLP acts for the insurers. In support of the allegation it served a witness statement exhibiting a spreadsheet drawn from a review of 372 claims. The spreadsheet listed claimants' names and details of their medical claims, including psychiatric referrals and diagnoses. A later version replaced names with Ersan reference numbers, following a County Court order in March 2023.

Three claimants brought this High Court action under the UK GDPR and the Data Protection Act 2018. They sought only declarations and compliance orders, not compensation. After a trial in June 2025, Eady J dismissed the claims, finding the processing lawful, fair and compliant with the other data protection principles relied on.

The question

On appeal, the claimants argued that the judge erred in law in her approach to proportionality. They said that processing their data without pseudonymisation was disproportionate and so a breach of the UK GDPR, that DWF might process data in this way in future, and that declarations should be granted.

The decision

The Court of Appeal dismissed the appeal.

The reasoning

Warby LJ held that this was a new, unpleaded case, advanced for the first time at the appeal hearing and inconsistent with the position the claimants took before the judge. They needed the court's permission and relief from sanctions to change their position. Assuming the court had jurisdiction to allow that, he saw no good reason to do so: it would be prejudicial to DWF and to the interests of justice, and the merits of the new case did not outweigh that prejudice.

Most fundamentally, he did not consider the factual propositions behind the new case to be arguable. There was no evidence of the alleged risk of future processing. The material before the court suggested that if there ever was such a risk, it had evaporated before the action was started. In any event, he said, this action would not be a suitable vehicle for dealing with any such risk.

A second ground of appeal, about the March 2023 order, was abandoned before the hearing, so the appeal proceeded on one ground.

At trial, Eady J had accepted evidence that names were needed at the outset to distinguish people involved in the same accident and to allow verification. She found the processing proportionate, noting that the claimants had provided the information with a view to litigation and could expect it to be scrutinised, and that DWF had later pseudonymised the data.

Sources

• Yesim Kul & Ors v DWF Law LLP [2026] EWCA Civ 1130, Court of Appeal (Civil Division), 27 August 2026