KB 2023 004108 - [2025] EWHC 1824 (KB)

The claimants’ case as pleaded was wide-ranging, albeit with a focus on the purpose for which the processing had been undertaken. By the time of the hearing, the claimants’ arguments had crystallised down, essentially focusing on the absence of pseudonymisation in JS1. Responding to the objection that this had not been pleaded, Mr Hanstock contended that it was encompassed within the complaints formulated under articles 5, 9, 14 and 17, arguing that this was relevant to arguments on necessity and proportionality, fairness and transparency, to whether the processing complied with the purpose limitation principle, and in assessing compliance with the principles of data minimisation, storage limitation, and integrity and confidentiality.

Accepting that the issue of pseudonymisation may well be relevant to an assessment of compliance with the data processing principles identified at article 5(1), and to questions of compliance with other provisions of the UK GDPR, I cannot see that the case now put on behalf of the claimants was clearly foreshadowed in the pleadings. Contrary to the requirements of Practice Direction 53B, the failure to pseudonymise was not specifically identified as an omission that had given rise to the UK GDPR breaches of which the claimants complained. While it is understandable that pseudonymisation was not sought as a remedy (by the time these proceedings commenced that had already occurred), if this was to be relied on as a basis for the claims, that ought properly to have been pleaded.

Although objecting to the way in which the claimants’ case has thus developed, the defendant did not seek to suggest that it was prejudiced in now dealing with the issues identified. I have therefore proceeded to consider the claims on the basis on which these have been presented to me at trial.