KB 2023 004108 - [2025] EWHC 1824 (KB)

As I have already indicated, identifying why the defendant undertook the data processing involved in JS1 establishes a prima facie lawful basis for that processing. Accepting that the claimants had not given their consent to the processing in question (although they had disclosed their personal data when intimating their intention to pursue a personal injury claim, there is no suggestion that they had done anything more than agree to the processing of that data in relation to their own claims), I am satisfied that the defendant has established that it was acting in compliance with its obligation to act on its clients’ instructions and in its clients’ best interests (article 6(1)(c)), that it was thereby acting in the public interest in ensuring the proper administration of justice (article 6(1)(e)), and that the processing was for the purposes of the legitimate interests of the defendant’s clients (article 6(1)(f)).

To a large extent, having regard to how the claimants’ case has developed, there is no real dispute in relation to these points. The more significant question, as identified by the claimants, is whether the processing was limited to that which was necessary. At the heart of the claimants’ complaint at trial is their contention that, absent pseudonymisation, the processing could not be said to be “necessary” for any of the purposes identified, and that, in particular given the weak evidential value of JS1, it was not proportionate given their interests and fundamental rights and freedoms.