KB 2023 004108 - [2025] EWHC 1824 (KB)

By their pleaded case, the claimants had focused on the question of purpose, contending that the use of their personal data beyond their own claims breached the purpose limitation under article 5(1) UK GDPR. Although not expressly conceding the issue, this was not an argument Mr Hanstock sought to develop at trial. It is, in any event, a bad point. The purpose limitation under article 5(1) is to be read subject to paragraph (5)(c) schedule 2 DPA 2018, which provides that the limitation will not apply to the disclosure of data necessary for the purposes of establishing, exercising or defending legal rights to the extent it would otherwise prevent that disclosure. Understanding that the original collection of the claimants’ data occurred as part of their own proposed claims for damages for personal injury, there was no continuing purpose limitation on the defendant’s disclosure of that data in the form of JS1 given that was (as I have already found) both necessary and proportionate for its furtherance of the plea of fundamental dishonesty that formed part of its clients’ defence in the County Court claims. Similarly, as I have previously observed (under “transparency”), the same point can also be made in respect of the claimants’ reliance in this regard on the transparency obligation under article 14(1)(c) (whereby a controller must inform a data subject of the purposes of the intended processing): that too is subject to the same, “legal rights” exemption.