KB 2023 004108 - [2025] EWHC 1824 (KB)

Having addressed the conditions relevant to the question of lawfulness under the first processing principle identified by article 5(1) UK GDPR, I turn to the questions of fairness and transparency. As Mr Hanstock observed in oral argument, while there is a considerable overlap between these factors and, indeed, those relevant to the question of lawfulness, these are distinct matters that must be the subject of separate, cumulative assessment.

As for whether the processing in this case was fair, I have kept in mind that this related to C2 as a child and, for each claimant, included special category personal data; I have proceeded on the basis that the data in question engaged the claimants’ article 8 ECHR rights, and have taken into account the likely disparity in resources between the claimants and the insurer clients of the defendants. Moreover, although not a statutory code, when assessing the issue of fairness, I have found it helpful to consider the questions identified in the ICO’s Guide to the UK GDPR.

Asking first how the data involved in JS1 was obtained, I do not consider this is a case where it can be said the claimants were deceived or misled by the defendant. Had they looked at the defendant’s website, they would have been advised of the potential use of their personal information in order to perform services for its clients, and that elements of that information might be disclosed to third parties. Even allowing that the claimants might reasonably not have taken that step, I am satisfied they would have been aware (albeit C2 would then have been acting through his father as his litigation friend) that information disclosed in (proposed) litigation would be the subject of scrutiny and investigation by the lawyers acting for the insurer defendants, and would be utilised in open court proceedings.

As for how the defendant’s processing of the data in question affected the claimants’ interests (either as a group or individually), given that the defendant only disclosed that data to the relevant courts and to the claimants’ own solicitors (or former solicitors), I cannot see that the impact on the interests of the claimants was more than minimal. Although the claimants have attested to having serious concerns about the inclusion of their data in JS1: (i) such concerns have to be seen in the context of the original disclosure of this data with a view to embarking upon person injury litigation in open court proceedings; (ii) in C1’s case, the data will be the subject of scrutiny in her on-going personal injury claim, in particular in the determination of the question of fundamental dishonesty in those proceedings; (iii) the objections expressed were largely focused on the disclosure of the data to the other claimants in the Ersan claims, which was not part of the processing undertaken by the defendant; and (iv) given the unsatisfactory responses as to how these proceedings were being funded, questions remain as to whether those concerns have been encouraged by Ersan.

I am, moreover, unable to see that the processing in issue has given rise to an unjustified detriment: the processing involved in JS1 was undertaken for lawful purposes and was necessary and proportionate for those purposes (see my reasoning, above). I am also unable to see that there can be any substantive complaint as to how the claimants have been treated when seeking to exercise their data protection rights. In this regard, I do not consider that the claimants are assisted by the right to erasure of data provided by article 17: even if a question arose as to the retention of data relating to C2 and C3 (as C1’s personal injury claim is still on-going, the same point cannot be made in her case), a right of erasure under article 17 does not apply where the processing is necessary for the “establishment, exercise or defence of legal claims” (article 17(3)); that, I am satisfied, is the position here. More generally, once the issue of admissibility had been resolved, and the Ersan claims returned to the County Court, the defendant offered to pseudonymise the data contained within JS1 for all future purposes (something that was done before the present proceedings commenced). Taking into account the obligations imposed by article 25, and the need to reduce the risks of wider disclosure of the claimants’ personal data as soon as possible (article 28; recital 78), I am satisfied that no unfairness arose from the processing involved in the creation of JS1 and its very limited disclosure by the defendant.

Separately considering the question of transparency, this is not a case where article 14 UK GDPR provides additional rights; even if the provision of information to the claimants would not have rendered impossible, or seriously impaired, the objectives of the processing involved in JS1, so as to engage article 14(5)(b), such rights are again exempted where, as here, the disclosure of the data in issue was necessary for the purposes of “establishing, exercising or defending legal rights” (paragraph (5)(c) Schedule 2 DPA 2018).

More generally, the claimants contend that the processing involved in JS1 was not transparent because it was not inherently foreseeable: acknowledging that those who pursue, or threaten, personal injury claims might reasonably expect a detailed investigation of their personal data, the claimants argue that the processing undertaken in this case went much further. Even if the premise of that objection is accepted (although, to the extent that questionable patterns are seen to emerge in a number of personal injury claims, where the claimants share some common denominator, I am not sure why an analysis of data across the different proceedings would not be an entirely reasonable expectation), this would still have to be assessed in light of the scope of the particular processing in issue. In this case, the disclosure undertaken by the defendant was limited to the claimants’ own solicitors and to the court. I cannot see that the defendant thereby acted in a way contrary to what might reasonably be expected in drawing Ersan’s attention to the evidential basis for its concerns, and in putting this before the court in support of its clients’ pleas of fundamental dishonesty in the County Court proceedings.

Having thus looked at the questions of lawfulness, fairness and transparency individually, I have then stepped back to consider, on a more holistic basis, whether the defendant can be said to have complied with the first data processing principle. In carrying out this assessment, it is important to consider the processing in issue in accordance with the proportionality principle; that, it seems to me, is a principle that runs like a thread through the protections provided by the UK GDPR (see recital (4)). Having identified the lawful purposes for which the defendant undertook the processing involved in JS1, I am satisfied, that, having regard to the requirements of fairness and transparency, this was limited to that which was necessary and proportionate to those purposes, and was not outweighed by the fundamental rights and interests of the claimants.