Factual and Procedural Background
The Appellants brought personal injury claims arising from road traffic accidents. The Defendant solicitors used information about those claims in other litigation to support allegations of fundamental dishonesty. The Appellants alleged that this processing of their personal data, including health information, breached the UK GDPR and the Data Protection Act 2018. [1][2][3]
Earlier objections to the use of the dataset were rejected, and the Information Commissioner’s Office found no evidence of a breach. The Defendant subsequently offered, and was ordered, to use a pseudonymised version of the dataset for the relevant claims. [4][5][6][7]
The Appellants commenced High Court proceedings seeking declarations and compliance orders, but not compensation. Their amended case concerned alleged past processing and did not plead future unlawful processing. Following a trial, Judge Eady dismissed all claims on 22 July 2025. [8][9][10][11][12]
On appeal, the Appellants advanced a new case that the Defendant might process their data without pseudonymisation in future and sought declaratory relief requiring pseudonymisation. The second ground of appeal was abandoned, leaving only the first ground. [13][14][15]
Legal Issues Presented
- Whether the Appellants should be permitted to advance, for the first time on appeal, a new case concerning future non-pseudonymised processing and related declaratory relief. [16][17]
- Whether permission should be granted to amend the Particulars of Claim and Grounds of Appeal after judgment and at the appellate stage. [17][18]
- Whether the proposed new case had sufficient legal and factual merit, including under the proportionality approach to data protection processing. [19][20]
- Whether there was any real risk of future use of the dataset without pseudonymisation, and whether this High Court action was an appropriate vehicle for addressing such a risk. [20][21][22]
Arguments of the Parties
Appellants’ Arguments
- The trial judge had failed to apply the correct proportionality principles and should have required the Defendant to use the least restrictive means, namely pseudonymisation. [23][24][25]
- The use of names was unnecessary and disproportionate because the names added nothing to the evidential patterns relied upon and increased the impact of serious allegations. [26]
- The Defendant should be declared obliged to pseudonymise the Appellants’ data in all relevant cases from the date of the trial judgment. [27][28]
- The Appellants argued that the March 2023 order applied only to five claims and that non-pseudonymised data might still be used in other proceedings. [26][24]
Defendant’s Arguments
- The Defendant argued that the appeal case was a departure from the pleaded case and had been raised too late. [29][30]
- The processing was lawful under Articles 6(1)(c), (e) and (f) of the UK GDPR because it was necessary for the administration of justice and the legitimate interests of the insurers and the Defendant. [31]
- Using names was initially necessary for accuracy, verification and reliability, while pseudonymisation became practicable later. [31]
- The proceedings were said to constitute an abuse of process by attempting to relitigate or circumvent issues addressed in earlier proceedings and the Ersan Undertaking. [32]
- The Defendant maintained that the March 2023 order governed use of the dataset across all relevant claims and that only the pseudonymised version was being relied upon thereafter. [33][21]
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Cooper v National Crime Agency | “Necessary” means more than desirable but less than indispensable, importing a proportionality approach. | The Court regarded it as binding authority supporting the trial judge’s approach and found no inconsistency with South Lanarkshire. [34][20] |
| South Lanarkshire Council v Scottish Information Commissioner | Observations concerning proportionality and balancing potentially conflicting rights. | The Court found no inconsistency between this authority and Cooper. [34][20] |
| Meta Platforms Inc | The three-fold legitimate-interest assessment, including the data subject’s reasonable expectations and the scale and impact of processing. | These principles were identified as the approach to Article 6(1)(f) necessity and proportionality. [35] |
| Koninklijke Nederlandse | Further observations relevant to the legitimate-interest balancing exercise. | The authority was cited alongside Meta Platforms Inc in identifying the relevant balancing considerations. [35] |
| Lumsdon v Legal Services Board | The proposed requirement to consider whether objectives could be achieved by a less restrictive scheme. | The Court held that reliance on this authority formed part of a new case and was not sufficient to justify amendment; it was also unlikely to produce a different proportionality outcome. [23][25][20] |
| Gover v Propertycare Ltd | An appeal court’s jurisdiction is constrained by the grounds of appeal and the grant of permission. | This supported requiring permission to introduce the Appellants’ substantive new case. [36] |
| Lighting and Lamps UK Ltd v Clarke | The approach to late amendments to grounds of appeal. | The Court applied its principles before considering relief from sanctions. [36][37] |
| Denton v TH White | Relief-from-sanctions principles. | The Court considered those principles in concluding that the very late new case should not be permitted. [36][38][39] |
| R (Hysaj) v Secretary of State for the Home Department | Principles relevant to relief from sanctions in the context of late amendments. | The authority was cited in explaining the applicable procedural sequence. [36] |
| Quah v Goldman Sachs International | The heavy burden faced by a party seeking a late amendment and the need for a good explanation and strong merits. | The Court relied on these principles in assessing prejudice, delay and the weakness of the proposed case. [40][19] |
| Mitchell v News Group Newspapers Ltd | The relevance of court resources and the interests of court users when considering amendments. | These considerations weighed against allowing the proposed amendment. [40] |
| Nesbit Law Group LLP v Acasta European Insurance Co Ltd | Late-amendment principles apply with greater rigour after trial and during an appeal. | The Court treated the timing of the proposed amendment as particularly significant. [40] |
| Vince v Tice | Appellate caution concerning new points, prejudice, further fact-finding and explanations for omission. | The Court assumed jurisdiction but concluded that the relevant factors clearly favoured refusing the new case. [41][42] |
| Notting Hill Finance Ltd v Sheikh | The appellate approach where a party seeks to raise a new point. | It informed the summary of principles governing new points on appeal. [41] |
| Prudential Assurance Co Ltd v Revenue and Customs Commrs. | Factors relevant to permitting a new point on appeal. | It was relied upon in formulating the applicable appellate approach. [41] |
| Singh v Dass | New points should generally not be allowed where they require new evidence or would have altered the trial; even pure points of law require adequate opportunity, absence of detriment and costs protection. | The Court relied on these principles in refusing to entertain the new case. [43][44][45][30] |
| Demetriou v Mopara | Restrictions on amending grounds of appeal to raise a new point and the inadequacy of a change of counsel as an explanation for delay. | The Court rejected the explanation that new counsel had brought “fresh eyes” to the case. [37][46] |
| Islington London Borough Council v Uckac | An example of permission being given to re-amend by adding a point not raised below. | The Court noted the authority but considered it unnecessary to resolve the jurisdictional issue. [42] |
| Aven v Orbis Business Intelligence Ltd | Whether declaratory relief is available in a data protection claim. | The Court regarded its jurisdiction to grant the proposed declarations as doubtful. [20] |
Court’s Reasoning and Analysis
The Court first characterised the appeal argument as a new, unpleaded claim. It sought different relief, relied on a future-risk allegation not pursued at trial, and departed from the factual and legal position adopted below. Permission would therefore have been required to amend both the Particulars of Claim and the Grounds of Appeal, as well as to raise the new point on appeal. [15][16][17]
The Court held that the proceedings below had focused exclusively on past processing. No evidence or trial resources had addressed a future risk of non-pseudonymised use. Allowing the new case would therefore prejudice the Defendant and potentially require fresh factual findings. [47][48][49]
The explanation that the new point had been identified by new counsel was inadequate. A change of counsel did not provide a good reason for failing to advance the point earlier. [50][46][51]
The proposed case was also legally weak. Cooper supported the “reasonable necessity” and proportionality test applied by the trial judge, and the Court found no conflict between Cooper and South Lanarkshire. It was not persuaded that applying Lumsdon would probably produce a different result. [19][20]
Most importantly, the factual basis for the alleged future risk was unsustainable. The March 2023 order was intended to resolve the issue across all relevant claims, and the Defendant confirmed that only the pseudonymised version had been relied upon since that order. The Court found no tenable basis for believing that non-pseudonymised use would occur. [20][21]
Even if concern had remained, the appropriate course would have been to seek assurances in correspondence and, if necessary, apply to the County Court dealing with the disputed claims. A fresh High Court action, particularly a new point on an appeal years after the relevant order, was inappropriate. [22][52][53]
Applying the relief-from-sanctions considerations, the default was serious, there was no application or supporting evidence, no good reason for the delay, and the proposed case would cause prejudice. The overall circumstances unequivocally favoured refusal. [54][38][39]
The Court declined to determine the separate abuse-of-process argument because there had been no relevant finding below and no Respondent’s Notice. It nevertheless observed that the appeal had wastefully consumed time and resources without any apparent good reason. [55][56]
Holding and Implications
The appeal was dismissed. The Court refused to entertain the new case and would have refused permission to amend the Grounds of Appeal and Particulars of Claim. [57][58][59][60][61][62]
The direct effect was that the Appellants obtained no declarations or compliance orders. The Court did not determine the abuse-of-process submission and did not establish a new broader precedent beyond applying existing procedural and data protection principles. [63][55][56]