Yesim Kul & Ors v DWF Law LLP [2026] EWCA Civ 1130

[2026] EWCA Civ 1130Case No CA-2025-002014
IN THE COURT OF APPEAL (CIVIL DIVISION)
[2025] EWHC 1824 (KB)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
KING’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Mrs Justice Eady
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 27/08/2026
Before
LORD JUSTICE NEWEYLADY JUSTICE ASPLINLORD JUSTICE WARBY
Between
YESIM KULAppellants/ ClaimantsROHAT MAHIRAppellantMAHMUT MAHIRAppellantDWF LAW LLPRespondent/Defendant
Richard Clayton KC (instructed by Ersan and Co Solicitors Ltd) for AppellantsRobin Hopkins KC (instructed by Clyde & Co LLP) for DefendantHearing Hearing date: 2 July 2026
Approved JudgmentThis judgment was handed down remotely at 10.30am on 27 August 2026 by circulation to the parties or their representatives by e-mail and by release to the National Archives..............................

LORD JUSTICE WARBY :

[1]The appellants made claims for damages for personal injury resulting from road traffic accidents (RTAs). The respondent solicitors (DWF), who acted for the defendants to those claims, used information about them in other personal injury litigation, to support a contention that the claims in the other litigation were fundamentally dishonest. The appellants brought this action against DWF, claiming that such use infringed their data protection rights. They did not seek compensation but only declaratory remedies and compliance orders under the Data Protection Act (DPA) 2018. The claims were dismissed after a trial by Eady J (the Judge), who found that DWF’s processing of the appellants’ personal data was lawful, fair, and compliant with the other data protection principles relied on. At the hearing of this appeal the appellants argued that(a) the Judge erred in law in her approach to proportionality;(b) she should have (i) held that processing their personal data without pseudonymising them would be disproportionate and for that reason a breach of the UK GDPR, (ii) found that DWF might engage in such processing in future, and (iii) granted declarations that this would be unlawful.[2]I would dismiss the appeal. My detailed reasons follow but can be summarised as follows. This is a new, unpleaded case. It was advanced for the first time at the hearing of the appeal. Legally and factually, it is inconsistent with the position adopted by the appellants before the court below. The appellants need the court’s permission and relief from sanctions to change their position at this late stage. Assuming the court has jurisdiction to allow this, I can see no good reason for doing so. It would be prejudicial to DWF, and to the interests of justice more generally. The merits of the new case do not outweigh that prejudice. Most fundamentally, I do not consider that the factual propositions on which the new case is based are arguable. There is no evidence of the alleged risk. The material before us suggests that if there ever was any such risk it had evaporated before this action was started. In any event, this action would not be a suitable vehicle for dealing with any such risk.

More about the factual and procedural background

[3]More about the factual and procedural background A group of insurers suspect that they and their insured have been the victims of a substantial number of fraudulent or dishonestly exaggerated claims for personal injury resulting from road traffic accidents, relying on bogus medical reports. In 43 claims of this kind (the Disputed Claims), brought in the County Court by clients represented by Ersan Solicitors (Ersan), the defendant has relied on the “fundamental dishonesty” provisions in the Qualified One-Way Costs Shifting (QOCS) regime that applies to personal injury claims. If fundamental dishonesty is established in any of these cases, the claimant is likely to have his or her claim dismissed (see s 57 of the Criminal Justice and Courts Act 2015) and/or to forfeit the costs protection afforded by the QOCS regime (see CPR 44.16(1)). DWF act for the defendants’ insurers, who are the substantive defendants to the Disputed Claims.[4]In support of their case of fundamental dishonesty, the insurers rely on a wider review they have commissioned of claims brought against their insured. The review related to 372 claims in respect of RTAs occurring between 22 February 2016 and 1 March 2021. In 367 of those claims the claimants were represented by Ersan. The review identified certain common themes and patterns that are capable, if substantiated, of supporting the allegations of dishonesty advanced in the Disputed Claims. A spreadsheet was prepared, listing cases with allegedly suspect features, and identifying those features (the Spreadsheet). Within the Spreadsheet are the names of the claimants in the cases reviewed, and some details about the medical claims advanced by them.[5]On 18 June 2021 James Stevens, a director and head of organised fraud at DWF, made a witness statement (the Stevens Statement) exhibiting the Spreadsheet as exhibit JS1. DWF served the Stevens Statement and JS1 on Ersan in their capacity as solicitors for the claimants in the Disputed Claims. The nature and substance of the case advanced in the Stevens Statement and Spreadsheet was self-evident on the face of the documents, but it was spelled out in a later statement of Mr Stevens, in which he said this: [the Spreadsheet] strongly indicates that all of the claims have been cynically managed so as to contrive an outcome whereby in every case, and irrespective of the true circumstances of that case, the Claimant is presenting a claim that they have suffered psychiatric harm as a result of the relevant index event. … it indicates that a cynical “conveyor belt” approach has been adopted … which approach the Claimants themselves have then readily exploited for the purposes of contriving their individual claims for psychiatric damage.[6]Service of the Stevens Statement and JS1 prompted a series of steps by or on behalf of those to whom it referred.[7]First, there were letters of objection from individuals included in the Spreadsheet, complaining that the inclusion of their personal data was a breach of their rights which could and should have been avoided by pseudonymisation. DWF and the insurers responded by relying on various UK GDPR exemptions for processing without consent.[8]Secondly, in August 2021, applications were made by Ersan in some of the Disputed Claims to debar DWF from relying, on behalf of its clients, on the Spreadsheet (the Debarring Applications). The applications were made on two grounds:(i) that the Spreadsheet was inadmissible quasi-expert evidence of an unreliable nature and(ii) that it contravened the UK GDPR. At the hearing of the Debarring Applications before HHJ Backhouse on 5 October 2021, Leading Counsel for the claimants dropped the second objection. The first was pursued but rejected by the judge. She held that the Spreadsheet contained admissible similar fact evidence, and that issues as to reliability would be for the trial judge. An appeal was brought against the rejection of the reliability argument. The data protection arguments were not revived. On 21 November 2022, Freedman J dismissed the appeal.[9]Thirdly, in and after about September 2021, Ersan raised complaints about the Spreadsheet with the Information Commissioner’s Office (ICO). The ICO rejected these on 5 January 2022, stating that no evidence had been identified that demonstrated that DWF had breached the requirements of the data protection legislation.[10]Fourthly, the issue arose at a hearing before HHJ Backhouse in March 2023. At this stage all the Disputed Claims had been stayed by consent. Ersan applied in five of the claims for disclosure of all the information relied on to create the Spreadsheet. The judge dismissed that application as misconceived because, among other things, the disclosure sought was unnecessary as(a) the information sought was in documents held by the claimants, and(b) DWF had offered to provide a revised version of the Spreadsheet replacing each claimant’s name with the Ersan reference number for that claimant. In the order reflecting her decisions at the March 2023 hearing (the March 2023 Order) at paragraph 4, the judge reflected DWF’s offer in a direction that by 4 April 2023 they must serve on Ersan a version of the Spreadsheet pseudonymised in the way they had offered, which they later did.[11]The fact that these issues had been raised and decided in only five of the Disputed Claims was addressed. Counsel for the claimants agreed that the judge’s directions would apply to all 43 Disputed Claims. Paragraph 1 of the March 2023 Order stated, “The stays are lifted on these 5 claims and all other claims in which [Ersan] act on behalf of the claimant(s) and [DWF] act on behalf of the defendant(s)”. DWF were ordered to file a schedule of “all the cases to which this paragraph applies”. Counsel gave an undertaking on behalf of Ersan, recorded in the order, that the firm would “not make further applications to debar the defendants or other insurers represented by [DWF] from relying on the [Stevens Statement] containing similar fact evidence” (the Ersan Undertaking).[12]Thereafter, those of the Disputed Claims in which the appeal to Freedman J had been brought were discontinued, without affecting the defence contentions as to fundamental dishonesty. The remaining Disputed Claims were reserved to HHJ Saunders who, by order dated 26 October 2023, directed a trial of one such claim and the issue of fundamental dishonesty in that claim, with the remaining claims being stayed meanwhile.

This action

[13]This action On 23 October 2023, Ersan filed in the High Court the Part 8 claim form in this action. The claim was brought on behalf of 127 of the individuals named in the original version of the Spreadsheet, all of whom had been represented by Ersan in relation to RTA claims threatened or issued. The claim, brought against DWF, complained of the processing of the claimants’ personal data, including health information, in “various RTA proceedings” by means of the Stevens Statement and the Spreadsheet. This was said to be in breach of Articles 5, 6, 7, 9, 13, 14, 17, 21 and 22 of the UK GDPR.[14]Three heads of relief were claimed:(1) Injunctive relief to restrain continued processing of the information. It was said that unless restrained DWF would continue to process the information in breach of duty and that “the basis of this belief is because the Defendant has disclosed the information in proceedings several times”.(2) An order under Article 21 of the UK GDPR for the blocking and/or erasure and/or destruction of the information “unlawfully held” by DWF.(3) A Declaration “that the Defendant has breached UK GDPR and/or the Data Protection Act 2018 and/or that they had no lawful basis for processing the Claimants’ data”. Claims were also intimated for misuse of private information and breach of confidence.[15]It is to be noted that the first two heads of relief were prospective, seeking relief in respect of future conduct which was said to be threatened, and unlawful. The third head of relief sought was a declaration of past wrongdoing.[16]By an amended claim form and Amended Particulars of Claim of December 2023, the claims for misuse of private information and breach of confidence were dropped, 124 of the claims were abandoned altogether and discontinued, and the scope of the data protection claims was narrowed. There was no allegation that DWF would engage in unlawful processing in future. The claim for injunctive relief was not pursued. The complaints of unlawful processing were phrased in the past tense. The relief sought by paragraphs 55 and 56 of the Amended Particulars of Claim was confined to declarations that DWF had infringed the UK GDPR in various ways, and various compliance orders under s 167 of the Data Protection Act (DPA) 2018, seeking erasure and blocking of existing records containing the appellants’ personal data. The prayer for relief was in these terms:- AND THE THREE CLAIMANTS CLAIM:(1) Declarations as aforesaid(2) Compliance orders as aforesaid(3) Such further relief as the Court deems just and equitable(4) Costs.

AND THE THREE CLAIMANTS CLAIM:

[17]The remaining three claimants, suing for these data protection remedies only, are the appellants, who have been referred to as C1, C2 and C3. I shall continue to use those labels.[18]C1, born in September 1985, was involved in an accident on 19 January 2019. Ersan were instructed to act for her. A claim was notified. Proceedings were issued in February 2022, relying on a medical report from a Dr Bansal and a psychiatric report from a Dr Yahli. C1 later abandoned her claim of psychological injury, and her reliance on Dr Yahli’s report. The defence relied on the making and abandonment of the psychological injury claim in support of a contention that there had been fundamental dishonesty. The Stevens Statement and the Spreadsheet are also relied on in support of that contention. C1’s claim, and the issue of fundamental dishonesty in that claim, remain pending. This is one of the Disputed Claims stayed by HHJ Saunders.[19]C2 and C3 were involved in an accident on 2 October 2016, when C2 was aged 10. Ersan were instructed to act for them. C2 notified a claim, in which C3 acted as his litigation friend. A medical report was obtained from a Dr Shaikh and a psychiatric report from Dr Yahli. Pre-action correspondence took place, and on 22 January 2019, C2’s claim was settled. C3’s claim, also relying on a report from Dr Shaikh, was brought in July 2017 and settled some three months later.[20]Information about C1, C2, and C3 and their claims was included in the Spreadsheet. The information included their names, the date of their accident, the DWF reference, and whether the claim was “pre-issue or litigated”. The Spreadsheet also recorded that the claimant had been referred to a psychiatrist, gave the name of the “first-tier expert” concerned, the date of the examination, the date of the report, the period between referral and report, phrases used in the report, the fact that the claimant had been referred to a further psychiatrist and the diagnosis.[21]The claims of C1, C2, and C3 went to trial before the Judge on 4 and 5 June 2025.

The trial

[22]The trial At the trial, Mr Hanstock, appearing for the appellants, further narrowed the scope of the claim. He focussed on the provision of JS1 to Ersan, to the court, and to the other claimants in the Disputed Claims, without pseudonymising C1, C2 and C3. He argued that processing of the appellants’ data by incorporating it in the Spreadsheet and Stevens Statement and thereby disclosing it in litigation involving other claimants, without consent, and without pseudonymisation, infringed the requirements of lawfulness, fairness, transparency, and the principles of purpose limitation, data minimisation, and storage limitation as well as the obligations concerning special category data. Each of the claimants gave evidence. The appellants also called evidence from a consultant solicitor named Christopher Gadd.[23]DWF accepted that the production and service of the Stevens Statement and Spreadsheet involved processing of the claimants’ personal data, including special category data, without consent. But they denied liability. DWF objected that the new way the claimants put their case at trial was a departure from the pleaded case. They also argued that, to the extent the appellants’ new case was legitimate, it was unfounded. DWF maintained that the processing complained of was lawful pursuant to Articles 6(1)(c), (e) and (f) of the UK GDPR because it was necessary for the administration of justice and/or necessary for the pursuit of the legitimate interests of the insurers and DWF as their solicitors, and not outweighed by any interests, rights or freedoms of the claimants. It was said that the inclusion of names was necessary to ensure accuracy, verification and reliability within the dataset, and that pseudonymisation had only become practicable later in the litigation. The use of names was also fair and did not infringe other data protection rights. DWF called evidence from Michael Henman, a partner at DWF.[24]DWF further contended that the proceedings were an abuse of process, amounting to an attempt to(i) use the appellants’ rights under the UK GDPR to relitigate issues raised but not pursued in other proceedings,(ii) circumvent the outcome of those proceedings and/or(iii) circumvent the Ersan Undertaking.

The judgment of Eady J

[25]The judgment of Eady J By her judgment and order dated 22 July 2025, the Judge dismissed all the claims. She noted that by the time of the hearing the appellants’ arguments had “crystallised down, essentially focussing on the absence of pseudonymisation in JS1”. She held that this was not a case that had been pleaded on their behalf, in accordance with PD53B paragraph 9. She considered it “understandable that pseudonymisation was not sought as a remedy (by the time these proceedings commenced that had already occurred)”, but if a failure to pseudonymise was to be relied on as a basis for the claims, it ought to have been pleaded. That said, in the absence of any identified prejudice to DWF the Judge proceeded to consider the claims on the basis on which they had been presented at trial.[26]The Judge identified some oddities about the appellants’ evidence. C1 had given evidence through an interpreter, despite having an English degree and describing herself elsewhere as a teacher of English as a foreign language. Mr Gadd’s evidence was “extraordinary”. He had no first-hand knowledge of the relevant events and was unable to explain why he was giving evidence other than to say that he was being paid to do so. The judge inferred that Mr Gadd had been put forward to avoid having to call someone from Ersan with direct involvement in the conduct of the proceedings. But none of this was decisive. The essentials of the Judge’s reasoning can be summarised as follows.

Processing

[27]Processing DWF had only disclosed the full dataset to Ersan and the courts. That was the relevant processing. Any wider circulation to other claimants had been carried out by Ersan, and DWF were not the data controllers in respect of that circulation.

Lawfulness

[28]Lawfulness DWF had established that the relevant processing was undertaken in compliance with its obligation to act on its clients’ instructions and in its clients’ best interests (article 6(1)(c)), that it was thereby acting in the public interest in ensuring the proper administration of justice (article 6(1)(e)), and that the processing was for the purposes of the clients’ legitimate interests and (article 6(1)(f)). The appellants accepted that the data analysis involved in JS1 was “necessary” for the purposes identified in these GDPR provisions. The core issue was whether the use of the appellants’ names, rather than pseudonyms, was “necessary” and, in particular, whether it was proportionate given, on the one hand, the allegedly weak evidential value of JS1 and, on the other, the appellants’ interests and fundamental rights and freedoms.[29]At [73]-[74] the Judge identified the approach to be taken to the questions of necessity and proportionality: 73. As is common ground between the parties, what is “necessary” in each of these respects is to be understood as meaning “more than desirable but less than indispensable or absolutely necessary”: Cooper v National Crime Agency [2019] EWCA Civ 16 at [89]-[90]. This imports a proportionality approach, which is familiar in the balancing of potentially conflicting rights and expressly acknowledged in recital (4) of the UK GDPR (and see the observations of Baroness Hale in SouthLanarkshire Council v Scottish Information Commissioner [2013] UKSC 55 at [25]-[27]). 74. More specifically, where a controller contends that processing was necessary for the purpose of a legitimate interest, pursuant to article 6(1)(f) UK GDPR, a three-fold test arises: the court will need to be satisfied not only(i) that the controller was indeed pursuing a legitimate interest, and(ii) that the personal data was processed for that purpose, but also(iii) that the interests or fundamental freedoms of the data subject did not take precedence over that legitimate interest, something that will require consideration of the reasonable expectations of the data subject as well as the scale of the processing and its impact on that person (see the observations of the Court of Justice in Meta Platforms Inc (Case C-252/21) [2023] 5 CMLR 22 at [106]-[110] and Koninklijke Nederlandse at [37]-[45] and [54]).[30]Applying these principles, the Judge accepted Mr Stevens’ evidence as to the need to use names in the first instance. This was that(a) DWF’s systems tracked accidents rather than individual claims, so that names were needed to distinguish between individuals involved in the same accident;(b) the use of names facilitated verification by Ersan; and(c) experience suggested that presenting statistics would generate demands for the disclosure of underlying documents. The Judge rejected the appellants’ argument that the fact that pseudonymisation was adopted later showed that it had not been necessary to use names at an earlier stage. She held that even if using individual names “could not be described as absolutely necessary … [it] was required at that stage to meet the problems that Mr Stevens had identified (a point made good by the detailed criticisms then made by Ersan as to the reliability of JS1)”.[31]The Judge further held that the relevant processing was proportionate and that the legitimate interests pursued by the insurers were not outweighed by the interests and fundamental rights and freedoms of the appellants. They had provided the information with a view to litigation, and could reasonably expect it to be scrutinised, analysed, used and disclosed by opposing lawyers and to be disclosed in open court. The data were relevant, in that DWF relied on JS1 in support of the plea of fundamental dishonesty. Whatever the appellants might say about the limited evidential value of JS1, it had been held admissible for that purpose. The relevant processing was limited in scope, and before the present proceedings began DWF had offered to pseudonymise the data contained in JS1 and had done so.[32]These conclusions were not affected by the fact that the data included medical information, which was special category data, or the fact that C2 was a child at the time. The relevant processing was necessary for the establishment, exercise or defence of legal claims within Article 9(2)(f), and C2’s position was protected by the role of his father as litigation friend.

Fairness and transparency

[33]Fairness and transparency The Judge observed that there was a considerable overlap between these matters and those she had dealt with in addressing lawfulness. She held that DWF were not guilty of any deception or misleading conduct. Their privacy notice explained that information from opposing parties might be processed and disclosed by them, and in any event a party to litigation should expect this. Bearing in mind the limited scope of the relevant processing, and the later pseudonymisation, the overall impact on the interests of the appellants was “minimal” and had not given rise to any unjustified detriment.

Other principles

[34]Other principles The Judge noted that the pleaded complaint that there had been a breach of the purpose limitation principle had not been pursued by Mr Hanstock. She held that it was a bad point in any event. The relevant processing fell within paragraph 5(3)(c) of Schedule 2 to the DPA 2018, which exempts processing that is necessary to establish, exercise or defend legal rights. Similarly, there was no breach of the data minimisation, storage limitation or security obligations. Although pseudonymisation was generally desirable where feasible, the use of names was justified at the initial stage. DWF had adopted pseudonymisation once that became available.[35]Abuse of process The Judge noted DWF’s argument on this issue, but also that it had not applied for the proceedings to be struck out, and had acknowledged that it could not be said that the claims brought by these appellants were properly to be treated as res judicata. The allegations of abuse could only be relevant to remedy or costs. For the reasons she had given there was to be no remedy.

The appeal

[36]The appeal The appeal was prepared and presented by Mr Clayton KC, who did not appear below. The appellant’s notice sought “A declaration that the Respondent breached Data Protection principles by acting disproportionately” and then repeated the prayer for relief at the end of the Amended Particulars of Claim (paragraph [16] above). In support of this relief two grounds of appeal were advanced, as follows: 1) The learned Judge erred in law in failing to apply EU proportionality principles set out by the Supreme Court decision in Lumsdon v Legal Services Board [2016] AC 69 and, in particular, the court was required to decide whether the respondent had established that its objectives could not be attained by means of a less restrictive scheme. 2) The learned Judge erred in law in misconstruing the nature and effect of para 4 of the Order [of] HHJ Backhouse made on 20 & 21 March 2023.[37]Nugee LJ granted permission to appeal on ground 1, reasoning that “if the data could have been pseudonymised (as it now has been in the proceedings before HHJ Backhouse) it is arguable that it should have been from the outset.” As will be clear from my summary of the hearing and judgment below, this ground of appeal advanced a new case, not argued below, in reliance on an authority that had not been cited. It represented a departure from the agreed position before the judge.[38]Nugee LJ’s response to ground 2 was, “I have not understood Ground 2 and, in so far as I have understood it, I do not see where it goes”; but he adjourned the application for permission to the hearing of the appeal “in case the full Court is persuaded that there is some merit in it after all.” DWF’s skeleton argument addressed ground two, inferring that the point was that because (according to the appellants) the March 2023 Order did not altogether prohibit the use of a non-pseudonymised version of the Spreadsheet it left open the prospect of DWF and the insurers deploying a non-pseudonymised version in other aspects of the Disputed Claims. DWF submitted that this was a bad argument, as the March 2023 Order “governed how JS1 was to be used across the [Disputed Claims] as a whole.” After service of DWF’s skeleton argument, but before the appeal hearing, ground two was abandoned. The appeal proceeded on ground one alone.[39]The opening section of the appellants’ replacement skeleton argument in support of the appeal focussed on DWF’s past conduct submitting, at paragraph 8, that the Judge “erred in law in failing to hold that the Respondents disproportionately interfered with the Appellants’ personal data by … processing their personal data in proceedings in relation to which the Appellants were not, themselves, parties”. At paragraphs 71 to 81 of the skeleton argument, the submissions were elaborated and extended. It was argued, first, that the March 2023 order “only applied to the five claims before” HHJ Backhouse, and that “the replacement JS1 was only served in respect of” those five claims and pursuant to a separate order made by HHJ Saunders in October 2024. It was alleged that DWF had “not pseudonymised the personal data of C1-C3 in many other claims.” Accordingly, it was said, DWF had failed to adopt the approach to pseudonymisation ordered by HHJ Backhouse and had thereby “failed to apply the least restrictive alternative test in relation to the extent” of DWF’s processing. (The emphasis in all these passages is in the original).[40]The skeleton argument further submitted that DWF’s processing was not proportionate for the purposes alleged and that it violated the data minimisation and storage limitation principles because(1) the names included in JS1 were irrelevant and unnecessary for the purpose of proving the patterns relied on;(2) the names added nothing to the impact of the patterns;(3) the failure to pseudonymise was aggravated by the seriousness of the allegations made, and the unfairness of disclosure without first allowing an opportunity to object. It was further said that the Judge should have held DWF in breach of the obligation under Article 25(1) of the UK GDPR to implement “appropriate technical and organisational measures, such as pseudonymisation” to implement data protection principles in an effective manner, with safeguards, and protect the rights of data subjects. The skeleton argument concluded with a submission that “the learned Judge erred in law by holding that it was proportionate to disseminate the Appellants’ personal data” (my emphasis).

The appeal hearing

[41]The appeal hearing At the outset of the hearing, the court asked Mr Clayton to clarify what remedies were sought, on what basis, and whether insurers had been asked if there was a risk of them using a non-pseudonymised version of JS1 in any proceedings. Mr Clayton adhered to the position that pseudonymised versions of JS1 had only been served in seven of the Disputed Claims. He accepted that there might be a question of whether the appeal was an academic exercise. But he submitted that if DWF’s position was that it was only going to proceed with pseudonymised versions in all the claims then it was for them to make that clear and make it good which, said Mr Clayton, they had not done.[42]Mr Clayton then developed his argument as to the error of law alleged, and the applicability of Lumsdon. Mr Clayton argued that Lumsdon was EU authority directly in point, whereas the approach adopted by the Judge relied on ECHR principles which had no proper place in the data protection context. Mr Clayton relied on Lumsdon for the proposition that the submission of a document which uses personal data to an extent that is not strictly necessary gives rise to liability under the data protection regime. He submitted that the Supreme Court decision in South Lanarkshire [2013] UKSC 55[2013] 1 WLR 2421 was consistent with Lumsdon but had not been referred to by the Judge. The decision of this court in Cooper was not consistent with Lumsdon, but Cooper was decided without reference to Lumsdon or South Lanarkshire and hence per incuriam.[43]Mr Clayton returned to the question of remedy, inviting us to conclude that the Judge had erred by concentrating on the lawfulness of events earlier than the hearing before her. She could and should have made declarations to the effect that “hereafter” the identity of C1, C2 and C3 should not be disclosed, their names must not be used, pseudonymisation should be used. That would have been an “efficacious” remedy that “met the case” by “looking to the future”. Ultimately, Mr Clayton framed his position in this way:
“I am not going beyond the declaration that I suggested would have been appropriate for the learned judge to make, which was to require pseudonymisation of all three claimants in respect of all cases as from the date she gave her judgment. That is the relief I seek. And everything else strikes me at least as unnecessarily complicated…”

Assessment

[44]Assessment The appellants’ case on appeal The claims advanced in this action have fluctuated and mutated over time. They changed more than once during this appeal. By the end of the hearing before us, the only contention that was being advanced on behalf of these three appellants was that the Judge erred by failing to find a risk that DWF would in future process their personal data in the form of a version of JS1 that was not pseudonymised, that this would be disproportionate and otherwise contrary to the UK GDPR and DPA 2018, and that declarations should be made accordingly.[45]This is another new way of putting the case – as one might say, a new, new case. There has never been any written statement of a claim for the declarations now sought. No such claim was pleaded in the Amended Particulars of Claim. The new claim lies beyond the parameters of the case as “crystallised” and presented to the Judge by junior Counsel previously instructed by the appellants. The new claim falls outside the scope of the relief sought in the appellants’ notice. It is not covered by the grant of permission to appeal. It is not a claim advanced in the replacement skeleton argument for the appeal. To make good their new case the appellants rely not only on a new proposition of law which is contrary to the agreed position before the Judge but also on factual propositions that were advanced in the claim form but abandoned in the Particulars of Claim, and which were not the subject of debate at the trial. The contention that there is a risk of future processing without pseudonymisation is directly contrary to the facts as found by the Judge. The position adopted by Mr Clayton at the hearing is not the same as the second ground of appeal, but it is hard to reconcile with the abandonment of that ground.[46]In these circumstances. as it seems to me, there are at least three conditions precedent to any determination by this court of the substantive merits of the appellants’ new, new case. The appellants require permission to amend their Particulars of Claim after judgment, they require permission to amend their Grounds of Appeal, and they need to persuade us that we should allow them to take a new point on appeal.

Principles

[47]Principles The jurisdiction of an appeal court is “constrained by what is in the grounds of appeal and in the grant of permission”: Gover v Propertycare Ltd [2006] EWCA Civ 340, [2006] 4 All ER 69 [10] (Buxton LJ). A substantive change of position requires amendment of the grounds of appeal. That may not be done without the permission of the appeal court: CPR 52.17 and, in the Court of Appeal, PD 52C para 30. An application for permission to amend should be made. The right approach to such an application, where it is made outside the time limit for appealing, was considered by this court in Lighting and Lamps UK Ltd v Clarke [2016] EWCA Civ 5. Vos LJ (as he then was) rejected a submission that the first step was to apply the principles relating to relief from sanctions by analogy (Denton v TH White [2014] EWCA Civ 906 [2014] 1 WLR 3926; R (Hysaj) v Secretary of State for the Home Department [2015] 1 WLR 2472). Vos LJ held that the court should first apply the principles governing late amendments and then address the Denton principles, as appropriate. Sir James Munby, P and Theis J agreed.[48]Parties seeking to amend their statements of case at a late stage face a heavy burden. The principles are identified in the judgment of Carr J, as she then was, in Quah v Goldman Sachs International [2015] EWHC 759 (Comm) [38], which has often been cited and applied. The financial impact on the opposing party of allowing the amendment remains a factor for consideration. But it is no longer the rule that costs, if they can be paid, are a sufficient compensation. The party seeking to amend will be expected to formulate the amendment and provide a good explanation of why it was not advanced earlier. They will need to persuade the court that the strength of their case is such as to eclipse or at least outweigh the interests of other parties to the litigation. The interests of court users generally, and the need to allocate fairly the limited resources of the court, are also material factors: see also CPR 1.1(2)(e) and Mitchell v News Group Newspapers Ltd [2013] EWCA Civ 1537, [2014] 1 WLR 795. As Sir Geoffrey Vos MR observed in Nesbit Law Group LLP v Acasta European Insurance Co Ltd [2018] EWCA Civ 268 [41], these principles apply with “even greater rigour” to an amendment sought “after the trial and in the course of an appeal.” The Denton principles are well known and need not be rehearsed here.[49]The approach an appellate court should take towards a new point raised for the first time on appeal has been considered on several occasions. A recent example is Vince v Tice [2026] EWCA Civ 844. In that case, as here, the appellant sought to raise on appeal a new point which would require permission for an amendment to the pleadings which had not been sought at first instance. The first question that arose was whether a decision can be said to be “wrong” within the meaning of CPR 52.1(3) because it did not address and find in favour of the appellant on a point of this kind. In a judgment with which Lewison and Coulson LJJ agreed I saw some force in the respondent’s argument that the court has no jurisdiction to allow an appeal on such a ground: see [56], [58]. It was not necessary to decide the point. At [56] and [59] I summarised the approach where the court does have jurisdiction to allow the new point to be taken, drawing on Notting Hill Finance Ltd v Sheikh [2019] EWCA Civ 1337, [2019] 4 WLR 146 [26] (Snowden J, as he then was), and Prudential Assurance Co Ltd v Revenue and Customs Commrs. [2016] EWCA Civ 376, [2017] 1 WLR 4031 [25] (Lewison LJ). I said this: 56 ... the court has a discretion to permit a party to advance a new case on appeal, if that is the just thing to do having regard to “an analysis of all the relevant factors” .... 59 ... “an appellate court will always be cautious before allowing a new point to be taken”. Among the factors to be considered are the nature of the proceedings which have taken place in the lower court, the nature of the new point, and any prejudice that would be caused to the opposing party if the new point is allowed to be taken. The court will rarely allow a new point to be taken where it would require further findings of fact, and will in any event expect “a cogent explanation of the omission to take the point below”.[50]Another well-known statement of the principles is to be found in Singh v Dass [2019] EWCA Civ 360. Having first referred to the general rule of caution to which I have referred, Haddon-Cave LJ (with whom McCombe and Moylan LJJ agreed) went on: 17. Second, an appellate court will not, generally, permit a new point to be raised on appeal if that point is such that either(a) it would necessitate new evidence or (b), had it been run below, it would have resulted in the trial being conducted differently with regards to the evidence at the trial. 18. Third, even where the point might be considered a ‘pure point of law’, the appellate court will only allow it to be raised if three criteria are satisfied: (a) the other party has had adequate time to deal with the point;(b) the other party has not acted to his detriment on the faith of the earlier omission to raise it; and(c) the other party can be adequately protected in costs.[51]In Demetriou v Mopara [2022] EWCA Civ 1001 this court, applying Lighting and Lamps UK Ltd v Clarke, refused an application made at the outset of the appeal for permission to amend the grounds of appeal to raise a new point by way of appeal, against a paragraph of the order below that had not previously been challenged. Here, the appellants go further, relying on a new point of law and a new factual case to seek relief which was not claimed in the proceedings below.

Submissions

[52]Submissions In his oral submissions Mr Clayton addressed, at the court’s request, the question of whether the appellants should be permitted to rely on Lumsdon. He accepted that this was a new point but argued that the ground of appeal for which permission was given raised a point of law resulting from the application to the case of fresh eyes. No application was made for permission to amend the appellants’ statement of case or their grounds of appeal. No draft Re-Amended Particulars of Claim were presented to us, nor were any draft Amended Grounds of Appeal provided. Mr Hopkins KC on behalf of DWF referred us to Singh v Dass and urged caution. He addressed the legal merits of the argument based on Lumsdon and the question of whether it would yield a different outcome if, contrary to his submissions, it applied to this case. He reiterated the points he had made in his original skeleton argument about the alleged risk of future use of JS1 without pseudonymisation.

Conclusions and reasons

[53]Conclusions and reasons I would refuse to entertain the new points on appeal, and I would have refused the applications which were not made, for permission to amend the grounds of appeal and to re-amend the Particulars of Claim. New points on appeal[54]Since Vince v Tice, I have become aware of a decision not cited in that case that may have some bearing on the first question we then addressed. In Islington London Borough Council v Uckac [2006] 1 WLR 1303 [36]-[41], this court gave the claimant permission to re-amend by adding a point not raised in the court below. I still see some force in the proposition that a decision cannot be criticised as “wrong” within the meaning of CPR 52.21(3) on the grounds that it failed to grant a remedy that was not being claimed at that time. However, the point was not argued before us and, as in Vince v Tice, it is unnecessary to decide it. Assuming we have a discretion to entertain the appellants’ new, new case, the application of the principles I have identified leads me to the clear conclusion that we would be wrong to do so.[55]The proceedings in the court below were entirely focused on whether, in the past, DWF had processed the appellants’ personal data by including them in the Spreadsheet, and in JS1, and disclosing that document to others. Considerable resources were devoted to that question, including not just the two-day trial but all the preparation work that went into that trial. No effort was devoted to examining whether there was a risk of future use of JS1 without pseudonymisation. It was taken as read, and the Judge plainly considered, that the effect of the March 2023 Order was that there was no prospect of such future use.[56]The second ground of appeal appears to have invited a departure from that common factual assumption. On one interpretation, ground 2 covered some of the territory that was later occupied by the new, new claim. But, in the knowledge of DWF’s argument that it was ill-founded, the second ground of appeal was expressly abandoned. The written argument that was then pursued was, predominantly at least, about what had happened in the past. There was no statement, or no clear statement, of any complaint about what might happen in future. There certainly was no claim for any relief restraining future processing of the Spreadsheet, nor for any declaration that this would be unlawful if it took place.[57]What happened at the hearing was, in terms of the remedies sought, an about turn. In my judgment, that was in and of itself unfair to DWF, regardless of any costs implications. But it does have costs implications. A claim for relief based on a future risk would require us to set aside the Judge’s uncontested conclusion on that point and to undertake, or direct, a fresh factual evaluation. Allied to this is the fact that the new claim rests on a new point of law which is also contrary to the position agreed at the trial. At the hearing we enquired whether the appellants were in a position to cover the additional costs incurred as a result of the changes in their position. This was not confirmed. The only explanation offered for any of this is the one I have mentioned: that the Lumsdon point was taken because new Counsel brought fresh eyes to the case. I do not think that is a good enough reason. I would echo the words of Lewison LJ in Demetriou v Mopara [22]:
“I do not regard a change of counsel as itself being a good reason for the delay in seeking to amend. The short point is that [the appellant] sought to raise a new point which his previous legal team had not thought of…”
Amendment[58]The next question, though academic, is whether, applying the principles identified above, permission should be granted to amend the Grounds of Appeal and Particulars of Claim. This raises considerations which overlap with but go beyond those with which I have already dealt. My reasons for concluding that permission to amend ought not to be granted are, briefly, these.[59]No good explanation has been provided for not taking the point earlier. The amendments have never been formulated in writing, and when the new case was put forward it was framed in a variety of ways. It is clear, though, that the amendments would be prejudicial to DWF in the ways I have outlined. The new, new case is by no means legally strong. In Cooper, the Court of Appeal rejected a challenge to the application in the data protection context of a test of “reasonable necessity”. On its face, Cooper is binding authority for the test applied by the Judge. That test has been applied in many other data protection cases before and since. The assertion that Cooper was decided without reference to South Lanarkshire is incorrect. The decision in that case was considered in Cooper in some detail: see the judgment of Sales LJ at [90]-[92]. In South Lanarkshire, the Supreme Court addressedthe European case law on proportionality. I do not detect an inconsistency between South Lanarkshire and Cooper. For these and other reasons, I am not at all convinced that the application of the Lumsdon principle would be likely to lead to a different conclusion on the issue of proportionality in this case. I also think it open to doubt that we have jurisdiction, in this data protection claim, to grant the declaratory relief claimed: see the discussion in Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB) [191].[60]Most compellingly of all, the appellants’ factual case for claiming relief in respect of future risk is, in my judgment, unsustainable. The submission that the outcome of the 2023 Order was no more than pseudonymisation for the five claims then before HHJ Backhouse is at odds with the record. The clear intention of the order was to resolve that issue for good, in all the claims. In her judgment after the trial of these claims, the Judge held that “once the issue of admissibility had been resolved, and the Ersan claims returned to the County Court, the defendant offered to pseudonymise the data contained within JS1 for all future purposes (something that was done before the present proceedings commenced)” (emphasis added). In response to the submissions made for the appellants at the hearing before us, Mr Hopkins assured us, on instructions, that this is in fact the position: as from the date of the March 2023 Order, it is only the pseudonymised version of the Spreadsheet that is being relied on. I have seen no good reason to doubt that is so. I can see no tenable basis for fearing, or asserting, the existence of a risk that absent a declaration of rights DWF would use JS1 without pseudonymisation.[61]Even if that were wrong, and there was any real room for concern, at any time after the March 2023 Order, that DWF might further process JS1 without pseudonymisation, the appropriate first step would have been to raise the matter in correspondence and seek assurances. Only in the absence of a satisfactory response would it have been appropriate to take any formal step. The appropriate legal remedy, if any, would have been an application to the County Court in respect of the Disputed Claims. It would not have been appropriate to raise the matter by way of a fresh High Court action such as this, still less by taking a new point on an appeal heard more than three years after the making of the March 2023 Order. The Denton principles[62]For good measure, I shall state my conclusions on this aspect of the matter. The default is plainly serious and significant, for reasons I have already stated. There is no application for relief from sanctions nor is there any evidence in support. No good reason has been put forward for not raising the point until this very late stage. The relevant circumstances include the prejudicial impact that taking the new, new point at this stage would have, and its merits. They also include the overall lack of procedural rigour and efficiency on the appellants’ side and the fact that, due to a generous exercise of discretion on the part of the trial Judge, they have already had the benefit of one late, unpleaded amendment. Those are matters relevant to factors (a) and (b) in CPR 3.9(1). Taken in the round, the circumstances point unequivocally in favour of refusing an extension of time for raising the new, new claim on this appeal.

Abuse of process

[63]Mr Hopkins submitted that there were no good reasons for bringing this appeal, or indeed the action itself, only bad ones. He asserted that the appeal was an attempt to get round the decision on the admissibility of JS1. This was, in substance, a repetition of the submission made to the Judge on abuse of process. In the absence of a finding below and any Respondent’s Notice I do not consider it would be appropriate to reach a conclusion on these submissions. I do however conclude that the appeal has been wasteful of time and resources in a way that is, fortunately, highly unusual, and without any good reason being apparent.

LADY JUSTICE ASPLIN I agree.

LORD JUSTICE NEWEY I also agree.