Pleading and Appellate Limits on GDPR “Least Restrictive Alternative” (Pseudonymisation) Claims in Litigation Disclosure

Case: Kul & Ors v DWF Law LLP
Citation: [2026] EWCA Civ 1130 (Court of Appeal (Civil Division), Warby LJ; Asplin LJ; Newey LJ)
Appeal from: [2025] EWHC 1824 (KB) (Media and Communications List, Eady J)
Date: 27 August 2026

1. Introduction

The appeal arose from a High Court Part 8 data protection claim brought by three individuals (the “claimants”) whose names and medical-claim details appeared in a spreadsheet exhibited to a witness statement served by solicitors (the “respondent firm”) in other road-traffic personal injury litigation. Insurers suspected a large pattern of dishonest or exaggerated claims supported by dubious medical reporting; the spreadsheet was deployed as “similar fact” material to support allegations of “fundamental dishonesty” in a group of county court claims.

The claimants did not seek damages. They pursued declaratory relief and compliance orders under the Data Protection Act 2018 (“DPA 2018”) and the UK GDPR, contending that using their identifiable data (rather than pseudonymised data) in other people’s litigation was unlawful, unfair, and contrary to data protection principles. The High Court dismissed the claim after trial. On appeal, the claimants attempted to recast the case as a forward-looking challenge seeking declarations requiring pseudonymisation “hereafter”.

The Court of Appeal dismissed the appeal, principally on procedural and forensic grounds: the case advanced at the hearing was a new, unpleaded, and factually unsustainable claim that should not be entertained for the first time on appeal.

2. Summary of the Judgment

  • Appeal dismissed. The Court of Appeal refused to entertain the claimants’ new “future risk” case (and indicated it would have refused the necessary permissions to amend pleadings and grounds).
  • New point / new case on appeal rejected. The claimants’ argument based on Lumsdon v Legal Services Board [2016] AC 69 and a “least restrictive alternative” requirement, and their reframing of remedies as prospective declarations mandating pseudonymisation, amounted to a “new, new case”.
  • Prejudice and case management. Allowing the shift would be unfair and prejudicial, require fresh factual evaluation, and offend the strict approach to post-trial amendments and new appellate points.
  • Merits not compelling. The asserted legal premise that Cooper v National Crime Agency [2019] EWCA Civ 16 was inconsistent with EU proportionality principles was not persuasive; Cooper remained binding and had considered South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55.
  • No factual basis for future risk. The record and findings indicated that from March 2023 onwards only a pseudonymised version of the spreadsheet was being relied on; there was no tenable basis for fearing future non-pseudonymised processing.
  • Proper forum. If any post-order misuse were feared, it should be addressed first by correspondence and (if needed) by applications in the ongoing county court proceedings—not by launching or reshaping High Court litigation, still less by new points on appeal.

3. Analysis

3.1 The precedent (what the case newly clarifies)

While the underlying dispute concerned pseudonymisation and proportionality in litigation-related processing of special category data, the Court of Appeal’s operative guidance is procedural and structural:

  • Data protection claims about litigation disclosure must be pleaded with precision (including the remedy sought—retrospective declarations vs prospective restrictions such as pseudonymisation orders).
  • Appellate courts will be slow to entertain new GDPR proportionality theories (including “least restrictive alternative” arguments) where they contradict the case run at trial, would require new fact-finding, or would prejudice the respondent.
  • Where the alleged problem is future conduct in ongoing litigation, the natural procedural route is within that litigation (case management, confidentiality, or evidential directions), rather than satellite High Court claims or late appellate reframing.

3.2 Precedents cited and how they shaped the outcome

A. Constraining the scope of appeals and late changes of case

  • Gover v Propertycare Ltd [2006] EWCA Civ 340: The appeal court’s jurisdiction is constrained by the grounds of appeal and the grant of permission. This underpinned the Court’s insistence that the claimants’ end-stage position fell outside both the pleaded case and the permitted grounds.
  • CPR 52.17 and PD 52C para 30: Substantive changes to grounds require permission; the Court highlighted that no formal application to amend grounds was made, and no draft amended grounds were provided.
  • Lighting and Lamps UK Ltd v Clarke [2016] EWCA Civ 5: Sets the sequence for considering late amendments on appeal: first apply principles for late amendments, then (as appropriate) the Denton v TH White [2014] EWCA Civ 906 relief-from-sanctions framework. The Court adopted this approach to explain why (even if entertained) amendments would be refused.
  • Quah v Goldman Sachs International [2015] EWHC 759 (Comm) and Mitchell v News Group Newspapers Ltd [2013] EWCA Civ 1537: Emphasise the heavy burden for late amendments and the modern primacy of efficient, proportionate litigation. The Court relied on this “heavy burden” paradigm, stressing that paying costs is not a complete answer.
  • Nesbit Law Group LLP v Acasta European Insurance Co Ltd [2018] EWCA Civ 268: Applies the late-amendment discipline with “even greater rigour” when amendments are sought after trial and on appeal. This directly supported refusing to permit the claimants’ re-engineered case.
  • Singh v Dass [2019] EWCA Civ 360: Restates why new points are generally barred on appeal—especially where they would change how the trial was conducted or require new evidence; even “pure law” points require safeguards (time to respond, no detrimental reliance, costs protection). The Court treated the claimants’ reframing as failing these conditions.
  • Vince v Tice [2026] EWCA Civ 844, Notting Hill Finance Ltd v Sheikh [2019] EWCA Civ 1337, and Prudential Assurance Co Ltd v Revenue and Customs Commrs. [2016] EWCA Civ 376: Provided the modern articulation of the discretionary (but cautious) approach to new appellate points. The Court applied these authorities to conclude it would be unjust to allow the new case.
  • Demetriou v Mopara [2022] EWCA Civ 1001: Refused late amendment to raise a new appeal point; emphasised that a change of counsel is not a good explanation for delay. The Court used this to reject “fresh eyes” as a justification.
  • Islington London Borough Council v Uckac [2006] 1 WLR 1303: Noted as a case where amendment was allowed on appeal; used to acknowledge (without deciding) the theoretical jurisdictional debate, while still refusing on discretion and justice grounds.

B. Proportionality in data protection and the attempted “Lumsdon” pivot

  • Cooper v National Crime Agency [2019] EWCA Civ 16: Central to the High Court’s approach (accepted at trial by both sides) that “necessary” means “more than desirable but less than indispensable”. The Court of Appeal treated Cooper as binding and widely applied in data protection cases; the claimants’ attempt to sideline it as per incuriam failed.
  • South Lanarkshire Council v Scottish Information Commissioner [2013] UKSC 55: Cited in the High Court for proportionality balancing, and used by the Court of Appeal to rebut the assertion that Cooper ignored it. The Court stressed that Cooper in fact discussed South Lanarkshire.
  • Lumsdon v Legal Services Board [2016] AC 69: Deployed on appeal to argue an EU-law “least restrictive alternative” requirement. The Court did not decide a full doctrinal reconciliation, but held that (i) this was a new legal point, (ii) it was contrary to the agreed position below, and (iii) it was not clearly outcome-determinative given the binding authority of Cooper and the factual findings.

C. GDPR legitimate interests balancing and CJEU guidance (as background)

Although the appeal ultimately turned on procedure and the absence of factual foundation for future risk, the High Court’s lawfulness analysis (which the appeal did not successfully dislodge) drew on:

  • Meta Platforms Inc (Case C-252/21) [2023] 5 CMLR 22: For the structure of legitimate interests balancing, including “reasonable expectations” and impact/scale.
  • Koninklijke Nederlandse (as cited): For proportionality and balancing within Article 6(1)(f) analysis.

D. Declaratory relief in data protection

  • Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB): Cited for doubt about jurisdiction/appropriateness of declarations in a data protection claim in some circumstances. The Court used it to underscore that the requested forward-looking declaration was not an obviously available or apt remedy, reinforcing the lack of “strength” needed to justify a late amendment.

3.3 Legal reasoning (why the Court decided as it did)

A. The appeal mutated into an unpleaded, prospective claim

The Court identified that, by the end of the appeal hearing, the claimants were no longer seeking a declaration about past processing, but a declaration aimed at future processing: that the respondent firm must not use any non-pseudonymised version going forward. That was outside:

  • the Amended Particulars of Claim (which had dropped forward-looking allegations and the injunction),
  • the appellant’s notice and the relief sought there,
  • the grant of permission to appeal, and
  • the replacement skeleton argument (which focused mainly on past dissemination and proportionality).

B. The Court required (but was not asked for) formal procedural steps

The Court held that three “conditions precedent” would be engaged before merits could be addressed:

  • permission to amend pleadings after judgment,
  • permission to amend grounds of appeal, and
  • permission to take a new point on appeal.

None were properly sought; no draft amendments were produced; and the justification (“fresh eyes”) was inadequate.

C. Prejudice, resource allocation, and the integrity of trial process

The new claim would have required fresh fact-finding about the risk of future processing—an issue not explored at trial. The trial and preparation had been directed to a different dispute (past lawfulness). This engaged the modern emphasis on:

  • finality and efficiency,
  • fair allocation of court resources (CPR 1.1(2)(e)), and
  • avoiding unfair tactical shifts that deprive the respondent of a fair opportunity to meet the case.

D. Weakness of the attempted legal pivot

Even if amendments were entertained, the Court considered the new “Lumsdon” proportionality argument not clearly strong enough to outweigh prejudice:

  • Cooper remained binding on the meaning of “necessary” in the data protection context, and had not been shown to be inconsistent with South Lanarkshire.
  • The claim that Cooper was per incuriam was undermined by the fact it had considered South Lanarkshire.
  • The sought declaration’s availability was itself doubtful in light of Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB).

E. The “future risk” factual premise was unsustainable

The Court treated this as the decisive practical point. The record showed that the March 2023 county court order was intended to resolve pseudonymisation for all the related claims, and the trial judge found pseudonymisation had been offered and implemented before the High Court action began. On instructions, the respondent confirmed that only the pseudonymised version was being relied on after March 2023. The Court found “no tenable basis” for fearing future non-pseudonymised use.

F. Proper vehicle and forum

Even if a concern had existed, the Court indicated the rational sequence would have been:

  • seek assurances by correspondence, then
  • apply (if necessary) to the county court within the ongoing personal injury proceedings,
  • rather than a separate High Court claim or a late-stage appeal reframing years after the relevant order.

G. Denton relief from sanctions (addressed “for good measure”)

Applying Denton v TH White [2014] EWCA Civ 906 by analogy, the Court held:

  • the default was serious and significant,
  • no good reason was given, and
  • overall circumstances (including prior indulgence at trial and the lack of procedural rigour) strongly favoured refusal.

3.4 Impact

  • Satellite GDPR litigation risk management. The decision discourages late-emerging GDPR arguments being used as satellite challenges to evidential steps in live litigation, especially where the practical issue can be handled by case-management directions in the underlying proceedings.
  • Pseudonymisation as an pleaded issue and remedy. Parties who contend that identifiable disclosure is disproportionate must plead it clearly—both as a breach theory (why identity is unnecessary) and as a remedial case (injunction/declaration/compliance order), at the correct stage.
  • “Necessity” remains tethered to established domestic authority. Attempts to reframe UK GDPR “necessity” as a strict “least restrictive means” test will face a steep climb where Cooper v National Crime Agency [2019] EWCA Civ 16 is engaged and where fact-sensitive proportionality balancing has already been carried out.
  • Appellate discipline reinforced. The judgment is a clear warning that appellate courts will not rescue or remodel data protection cases that were abandoned, narrowed, or strategically reformulated below.

4. Complex Concepts Simplified

4.1 “Processing”, “controller”, and litigation disclosure

“Processing” under the UK GDPR is broad and includes compiling, storing, and disclosing personal data (for example, exhibiting a spreadsheet to a witness statement and serving it in litigation). A “controller” is the party who determines the purposes and means of processing. The High Court found that the respondent firm’s relevant disclosure was to the claimant solicitors and the courts; any wider onward sharing to other claimants was done by the claimant solicitors, not by the respondent as controller.

4.2 “Necessary” does not mean “indispensable”

In this context, “necessary” generally means more than merely helpful, but not strictly indispensable. That is why courts perform a proportionality-style balancing exercise (particularly under Article 6(1)(f) “legitimate interests”), considering reasonable expectations, scale, and impact.

4.3 Pseudonymisation

Pseudonymisation replaces names with identifiers (e.g., reference numbers) to reduce privacy intrusion while preserving utility. It is often desirable, but whether it is required depends on context: the stage of proceedings, system constraints, accuracy/verification needs, and the fairness/impact assessment. In this case, the appeal failed not because pseudonymisation is irrelevant, but because the appellants’ final case depended on an unproven future risk and an unpleaded remedial theory.

4.4 “Fundamental dishonesty” and the use of similar fact material

Allegations of “fundamental dishonesty” (linked in the judgment to s 57 of the Criminal Justice and Courts Act 2015 and CPR 44.16(1)) can have drastic consequences in personal injury litigation. Insurers may deploy patterns across claims (“similar fact” material) to support such allegations. That litigation context shaped the courts’ readiness to view scrutiny and disclosure as within reasonable expectations of parties who place injury and medical effects in issue.

5. Conclusion

Kul & Ors v DWF Law LLP [2026] EWCA Civ 1130 is a leading procedural reminder in the data protection–litigation interface: parties must plead GDPR proportionality and pseudonymisation complaints (and the precise remedies sought) at first instance, and cannot expect the Court of Appeal to entertain newly minted “least restrictive alternative” theories or prospective declaration claims that contradict the case run below. Where the real issue concerns future handling of documents in ongoing proceedings, the proper course is correspondence and (if needed) applications in those proceedings—not late-stage, satellite appellate reformulation.