KB 2023 004108 - [2025] EWHC 1824 (KB)

Turning then to the way the case is put on necessity and proportionality, accepting that it was necessary to carry out the data analysis involved in JS1 for the purposes identified (a legal obligation; the public interest in the administration of justice; the legitimate interests of the defendant’s clients), the claimants contend that there was, however, no necessity in the use of their names: the information (which included information of a personal and sensitive nature) could have been presented in pseudonymised form, which could have been used in the County Court proceedings – thus meeting the objectives identified by the defendant – without breaching their right to privacy (a fundamental right under article 8 of the European Convention of Human Rights (“ECHR”)) and, more generally, their interest in not adding to the numbers of those aware of information disclosed in their claim notification forms. The claimants further say that intimating an intention to bring a County Court claim, and even commencing proceedings, does not give rise to a reasonable expectation that the personal data thereby disclosed will be used in other claims (to which the claimants are not themselves parties) and for a different purpose. To the extent the defendant’s privacy notice warned of such a possibility, each of the claimants says they were unaware of this: they had not thought to look at the defendant’s website and C2’s claim had been settled sufficiently early that dealings had still been with the insurer.

In order to determine whether the processing in this case – specifically, the use of the claimants’ names – was “necessary”, the first question must be why was this done? The answer to that is provided in JS2 at [52], where Mr Stevens explained how he was unable to simply use the defendant’s case management system, which references accidents not individuals (as many accidents will give rise to multiple claims from those present, this would impact on the clarity and reliability of the data), nor could he use initials or even just surnames (inevitably those involved in a road traffic accident may well be members of the same family, who had been travelling together, and who will often share names). Moreover, having reflected on Ersan’s reaction to an earlier, smaller, similar fact exercise (see JS2 at [58]), Mr Stevens considered that requests would inevitably be made for further clarification and for copies of all source material if he attempted to summarise the information. Given that he would be providing the data to solicitors who had been instructed to act for all those named within the spreadsheet attached to JS1, and who had thus already had the information in question (Ersan’s own claim notification forms having been the defendant’s source for JS1), Mr Stevens took the view that this was a necessary and proportionate means of processing the data. Accepting that another way of processing the information – pseudonymising names by using Ersan’s client reference numbers – was subsequently deployed, I do not consider that means that the original presentation of data was not “necessary” (perCooper v NCA). Even if it could not be described as “absolutely necessary”, using individual names was not “merely desirable” but was required at that stage to meet the problems that Mr Stevens had identified (a point made good by the detailed criticisms then made by Ersan as to the reliability of JS1). After the information had been filed with the court and served on Ersan, it was possible to agree an alternative way of presenting the data; before that initial step, however, I am satisfied that the processing undertaken in JS1 was “necessary” for UK GDPR purposes.

Moreover, understanding “necessary” to require an assessment of proportionality, for the reasons explained in the paragraphs that follow, I am satisfied that the processing in issue was both necessary for the pursuit of the defendant’s legitimate objectives and that those objectives were not outweighed by the interests or fundamental freedoms of the claimants (questions that are expressly raised when considering whether the processing was necessary for the purposes of a legitimate interest, pursuant to article 6(1)(f)).

In thus assessing the question of proportionality, it is relevant that the processing in issue related to data that had been provided by the claimants with a view to commencing personal injury claims before the court. Given the primacy afforded to open justice in court proceedings, it would have been a reasonable expectation that the information in question – including special category data for article 9 purposes - would thus be disclosed in open court (certainly, there was no suggestion that anonymity orders were to be sought). Even if (as in C2’s case) the proposed claim was compromised before issue, each of the claimants would reasonably have expected the information they were seeking to rely on (including medical information relevant to the claims) to be disclosed to the lawyers acting for the insurers, and for that information to then be investigated and analysed, with a view to any potential defence. Had the claimants looked at the defendant’s website, this point would have been made express through its privacy notice; allowing, however, that not all individuals who bring claims against the defendant’s clients could reasonably be expected to take such a step, I still have to consider the question of proportionality in light of the fact that the data in question was disclosed by the claimants with a view to embarking on litigation in open court, with all that that implies.

It is also relevant for me to have regard to the scale of the processing in issue, and its impact on the claimants. Although the analysis that led to JS1 plainly involved a large number of individuals, all were claimants, or potential claimants, in (proposed) County Court proceedings, and they would have been aware that their data was to be disclosed to the defendant and (if proceedings were commenced) to the court. As for the defendant’s disclosure, that was very limited: JS1 was filed with the court and sent to Ersan. Although Ersan could reasonably be expected to then take instructions on JS1 and/or to inform its clients about it, that could have been done without the provision of all the names in the spreadsheet: Ersan could have redacted all information but for that relating to the particular client to whom it was being sent; I cannot see that the defendant can be held responsible for Ersan’s failure to take that obvious step.

For the claimants it is further contended that, to the extent the defendant’s processing of data was in pursuit of a lawful purpose falling within article 6, the unreliability of JS1 was such that the balancing exercise at the heart of the proportionality assessment (whether undertaken for article 6(1)(f) purposes or, more generally, through the prism of assessing necessity in this case) must weigh against the defendant. The difficulty with that submission is, however, that all attempts to debar reliance on JS1 on reliability grounds have failed, and Ersan have undertaken not to pursue further applications; whatever observations have been made as to the potential evidential difficulties relating to JS1, the defendant is entitled to rely on it in the County Court proceedings and it forms an important part of the plea of fundamental dishonesty that has been made in a number of those claims.

In these circumstances, given what the claimants might reasonably have expected to be the consequence of commencing (or threatening to commence) their personal injury claims, and balanced against the limited scope of the processing (disclosed by the defendant only to the court and to Ersan, and subsequently subject to pseudonymisation), I do not consider that the interests or fundamental freedoms of the claimants took precedence over the legitimate interest of the defendant’s insurer clients in putting the data contained within JS1 before the court to support pleas of fundamental dishonesty in the County Court proceedings.

In reaching this conclusion, I have taken into account that JS1 involved data relating to a child, C2, which is expressly identified as a relevant consideration for the purposes of article 6(1)(f), and that it further included data relating to the health of each of the claimants, thus engaging article 9 UK GDPR. Taking the latter point first, although article 9(1) prohibits the processing of such special category data, that prohibition is lifted where, and to the extent that, a lawful processing condition under article 9(2) applies; in the present case, given that the processing was necessary for the establishment of the plea of fundamental dishonesty, and thus for the defendant’s clients’ defence of legal claims, JS1 fell within the exception allowed by article 9(2)(f). As for C2’s position as a child, he was protected at the relevant time by the involvement of his father, C3, as his litigation friend, who had (on C2’s behalf) agreed to the notification of a proposed personal injury claim. In the circumstances, having regard to the matters I have already identified, I am both satisfied that JS1 was necessary for a lawful processing condition, as identified by article 9(2)(f), and that C2’s status as a child does not alter the balancing exercise under article 6(1)(f) in this case.