Background
The appellants had pursued personal-injury claims arising from road traffic accidents. DWF Law LLP, acting for defendants and their insurers in other claims, included information about the appellants in a spreadsheet used as similar-fact evidence to support allegations that a group of personal-injury claims was fundamentally dishonest. The spreadsheet contained names and information about medical claims, including special-category health data.
The appellants brought proceedings under the Data Protection Act 2018 and the UK GDPR, seeking declarations and compliance orders but no compensation. Eady J dismissed the claims after trial, holding that DWF’s processing was lawful, fair and proportionate. She found that using names initially assisted identification and verification, that the processing was necessary for legal claims and the administration of justice, and that DWF later pseudonymised the spreadsheet for future use.
On appeal, the appellants ultimately sought declarations addressing possible future use of a non-pseudonymised spreadsheet. They argued that proportionality required use of the least restrictive means and that DWF should be required to pseudonymise their information in all relevant proceedings.
The Court’s Holding
The Court of Appeal unanimously dismissed the appeal. Warby LJ held that the appellants’ final argument was a new and unpleaded case, seeking relief that had not been claimed at trial, was outside the grounds and permission for appeal, and depended on factual propositions not examined below. The appellants had not applied to amend either their pleadings or their grounds of appeal.
The court would not permit the new case to be advanced. Raising it after trial would prejudice DWF, potentially require a fresh factual inquiry, and lacked a cogent explanation; the involvement of new counsel with “fresh eyes” was insufficient. The court also found the proposed legal argument weak because existing Court of Appeal authority supported the reasonable-necessity test applied by Eady J.
Most importantly, the alleged risk of future non-pseudonymised processing was unsustainable. The March 2023 County Court order was intended to resolve pseudonymisation across all the disputed claims, Eady J had found that pseudonymisation had occurred for all future purposes, and DWF confirmed that only the pseudonymised spreadsheet had been relied upon since that order.
Key Takeaways
- An appellant ordinarily cannot recast a decided claim into a new factual and legal case without permission to amend the pleadings and grounds of appeal.
- Late amendments after trial face especially rigorous scrutiny, including their explanation, prejudice to the opposing party, evidential consequences and substantive merits.
- The court found no tenable basis for anticipating future use of the appellants’ data without pseudonymisation, leaving Eady J’s dismissal of their UK GDPR claims undisturbed.
Why It Matters
The decision underscores that data-protection challenges arising from litigation must be pleaded precisely, including whether they concern past processing or seek prospective relief. A party cannot use an appeal to introduce an untried claim based on a future risk that the evidence does not support.
For litigators handling personal and health data, the judgment also confirms the relevance of reasonable necessity, proportionality and later pseudonymisation when assessing processing undertaken to establish, exercise or defend legal claims.