KB 2023 004108 - [2025] EWHC 1824 (KB)

Finally, I turn to the third, fifth and sixth processing principles under article 5(1), and the requirements of data and storage minimisation (5(1)(c) and (e)), and of integrity and confidentiality (5(1)(f)). As I have previously noted, at trial, the claimants’ case under these headings crystallised down to the objection that the data involved in JS1 ought to have been the subject of pseudonymisation; it is the claimants’ case that the use of names was unnecessary and failed to ensure security.

Given that the processing of personal data should be limited that which is necessary in relation to the purpose of that processing, kept in a form which permits identification of the data subject for no longer than is necessary, and processed in a manner that ensures appropriate security, I accept that pseudonymisation would be a potentially relevant means of complying with these obligations, not least as it could provide appropriate security of the personal data and the reduction of risk (see recital (28)). Having regard to the detailed explanation provided (see JS2), I am, however, satisfied that no breach of these requirements arises in the present case. No issue has been identified regarding the defendant’s processing or storage of the claimants’ personal data prior to the disclosure of JS1. Allowing that the defendant was entitled to rely on the analysis within JS1 to pursue its clients’ case as to fundamental dishonesty, the claimants’ objection is to its failure to pseudonymise their data when seeking to do so.

For the reasons I have already identified, however, it is apparent that the use of names was necessary at the point JS1 was disclosed to Ersan and the court (see the explanations at JS2 [52] and [58]). Although I cannot see that it was necessary for the non-pseudonymised data to then be disclosed to the claimants listed in the spreadsheet that formed part of JS1, that was done by Ersan not the defendant. Moreover, on the evidence before me, I am satisfied that, at the point that an alternative means was identified such that the data subjects referenced in JS1 could be identified by alternative means (Ersan’s own client reference numbers), the defendant duly pseudonymised the information.