Dr Shimaa Hatab v King’s College London [2026] EWHC 1736 (KB)

Venue IN THE ROYAL COURT OF JUSTICEKINGS BENCH DIVISION[2026] EWHC 1736 (KB)Case No KA-2025-000136Courtroom No. 13Venue Royal Courts of JusticeStrandLondonWC2A 2LLDate Friday, 12 th June 2026
Before
THE HONOURABLE MR JUSTICE SWEETINGB E T W E E N:DR SHIMAA HATABKING’S COLLEGE LONDONTHE APPLICANT appeared in PersonMR MCCARTHY appeared on behalf of the RespondentJUDGMENTApprovedThis Transcript is Crown Copyright. It may not be reproduced in whole or in part, other than in accordance with relevant licence or with the express consent of the Authority. All rights are reserved.
Between
Dr Shimaa HatabClaimantKing’s College LondonDefendant
[1]This is a renewed application for permission to appeal following refusal on the papers.[2]The appellant, Dr Shimaa Hatab, brought proceedings in the County Court by way of a Part 8 claim issued on 29 January 2024, against King’s College London, KCL. The claim formed part of a wider history of litigation between the parties including several Part 7 proceedings alleging breaches of the United Kingdom’s General Data Protection Regulation (“the UK GDPR”), employment tribunal proceedings, which had been dismissed subject to a limited outstanding issue, and a number of procedural applications and appeals.[3]The appellant is a litigant in person. She is an academic in the field of politics and was a polite and articulate advocate on her own behalf.[4]The Part 8 claim sought relief under section 167 of the Data Protection Act 2018 (“the DPA 2018”) which empowers the Court to make a compliance order requiring a data controller to take steps to comply with data protection legislation where there has been an infringement of a data subject’s rights.[5]In substance the appellant contended that KCL had failed properly to comply with her rights of access to personal data under Article 15 of the UK GDPR.

The judge’s assessment of the appellant as a witness included the following:

“I found the claimant to be a straightforward witness who is clearly genuine in her beliefs and frustrated at what she saw as the failure by the IT and Cyber Security teams at KCL to fully understand the basis of her concerns. It was clear to me that whatever explanation or reassurance she was given, it was not likely to alter her belief that she had been the victim of some unauthorised interference of her IT systems by third parties.”
[7]Then, a little later

the judge said:

“she strongly believes that her career progression has been affected by the actions of malicious third parties. She also accepted in her oral evidence that she formed the belief that KCL staff were either directly involved in leaking information or at least hiding information from her.”
[8]The information sought by the appellant was extensive. She sought amongst other matters unredacted email activity logs over a two-year period, the content of allegedly deleted or encrypted emails and identifying information concerning users of her institutional accounts and devices. These requests were linked to her allegation that her accounts had been accessed by unauthorised third parties, a matter which she asserted had not been adequately investigated by KCL.[9]It is, however, material that the scope of the relief sought in the Part 8 claim did not correspond precisely to the data subject access requests (“DSARs”) which the appellant had previously made to KCL. The DSARs themselves were narrower in scope than the categories of information sought in the proceedings. Since the statutory jurisdiction under section 167 is predicated upon establishing an infringement of data subject rights this divergence was of some significance to the issues before the Court.[10]The claim came before Ms Recorder Padley for trial on 30 April 2025. By a detailed extemporary judgment given on 1 May 2025 the Recorder dismissed the claim in its entirety. In summary, the Recorder found that KCL had not infringed the appellant’s rights under the DPA 2018 or the UK GDPR in responding to her DSARs, having taken reasonable and proportionate steps to search for and provide personal data.[11]In reaching that conclusion the Recorder addressed each category of request, she found in particular that certain of the information sought did not constitute the appellant’s personal data; that compliance with aspects of the requests would have involved disproportionate effort and the disclosure of other materials was properly refused on the grounds that it comprised third party personal data protected by the statutory exemptions.[12]As to the appellant’s allegation of unauthorised access to her emails, the Recorder accepted KCL’s evidence that it had conducted a detailed investigation and had found no evidence of any such data compromise.[13]The Recorder further held that some elements of the claim were misconceived because the underlying information had never in fact been requested by way of a DSAR with the consequence that the jurisdiction to grant a compliance order did not arise in respect of those matters.[14]More generally she concluded that KCL had responded reasonably and proportionately throughout and that even if there had been any breach she would in any event have declined to grant a compliance order on grounds of proportionality.

The Recorder also made an order for costs against the appellant in the sum of £50,000 plus vat.

[16]The appellant sought permission to appeal. That application was considered on the papers by Ritchie J and refused by order dated 23 February 2026. In refusing permission, he described the Recorder’s reasoning as clear and correct in law. He concluded that the proposed grounds for appeal were unarguable. Ritchie J also identified certain procedural deficiencies in the appeal, including matters related to timing and compliance with the rules as to service. His conclusion as to the timing of service was, as matter of fact, incorrect and the appellant has now remedied the lack of an English address for service on her. I therefore put these procedural matters to one side.[17]The appellant now applies to set aside the refusal of permission to appeal and to pursue her appeal against the order of Recorder Padley dismissing her Part 8 claim. The appellant advances five grounds of appeal against the decision of Recorder Padley which are detailed, but which can be summarised as follows.[18]First, it is contended that the Recorder erred in her application of DPA 2018, in particular by adopting an unduly broad approach to the third-party data exemption and by mischaracterising materials such as email logs as falling outside the scope of the appellant’s personal data. It is further said that the Recorder failed properly to apply the principle that exemptions should be construed narrowly and overlooked the appellant’s entitlement to information concerning the recipients of her personal data including in the context of alleged unauthorised access.[19]Secondly, the appellant contends that the Recorder misapplied the test of proportionality. In this regard it is said that insufficient scrutiny was given to the steps actually taken by KCL to comply with the relevant requests, that the burden of compliance was overstated and that the Recorder wrongly treated the requests as being pursued for a collateral purpose. The appellant further contends that inadequate weight was given to the alleged absence of any effective investigation into the asserted data breach and to the lack of alternative means by which she could obtain the information sought.[20]Thirdly, it is said that the decision was vitiated by procedural irregularity in the assessment of the evidence. In particular, the appellant contends that the Recorder failed to engage with materials said to indicate unauthorised access to her accounts, accepted unsubstantiated assertions as to data deletion and wrongly characterised her requests as vague.[21]Fourthly, the appellant submits that the Recorder misinterpreted section 167 of the DPA 2018. It is argued that the statutory threshold for the making of a compliance order was misconstrued, the discretion to grant relief was wrongly exercised by reference to irrelevant considerations including the anticipated use of the data and that insufficient weight was given to the appellant’s right to determine the value of accessing her own personal data.[22]Finally, the appellant challenges the costs order. It is said that the award of £50,000 plus vat was disproportionate, failed properly to reflect the nature of the proceedings and did not take account of her personal financial circumstances, thereby operating as an unjust barrier to access to justice.[23]Under CPR Rule 52.61 permission to appeal may be given only where this Court considers that a) the appeal would have a real prospect of success or b) there is some other compelling reason for the appeal to be heard. An appeal will normally be limited to a review of the decision of the lower court. An appellate court should be slow to overturn findings of fact made by a trial judge who has seen and heard the witnesses; indeed, where credibility is an issue such findings will only be overturned where the judge is plainly wrong. In Prescott v Potamianos also known as Re Sprintroom [2019]2BCLC 617 at paragraph 76 the Court of appeal stated “on a challenge to an evaluative decision of a first instance judge the Appeal Court does not carry out a balancing task afresh but must ask whether the decision of the judge was wrong by reason of some identifiable flaw in the judge’s treatment of the question to be decided such as a gap in logic, a lack of persistency or a failure to take account of some material fact which undermines the cogency of the conclusion.” Although that case related to a different legal scenario, the observations made by the Court of Appeal can be applied equally in relation to the material issues in this case.[24]I have listened carefully to the submissions made by Dr Hatab but in my view the proposed appeal discloses no real prospect of success. The Recorder directed herself correctly as to the governing statutory framework under the DPA 2018 and the UK GDPR including the requirements for establishing an infringement of Article 15 rights and the limits of the Court’s powers under section 167. Her conclusions that KCL had taken reasonable and proportionate steps in response to the appellant’s data subject access requests were findings which were plainly open to her on the evidence.[25]The criticisms advanced in Grounds 1 and 2 do not disclose any arguable error of law. The Recorder was entitled to find that significant elements of the materials sought did not constitute the appellant’s personal data and that in any event compliance with the request which was expansive in its scope encompassing email logs, sender and recipient information and IP data over an extended period would have imposed a disproportionate burden on KCL. In that context her consideration of the third-party data exemption was both orthodox and necessary, given that disclosure would inevitably involve the personal data of other identifiable individuals.[26]Further, insofar as the appellant’s request where premised upon the alleged hacked or deleted emails, the Recorder accepted KCL’s evidence that a detailed investigation had revealed no such material with the result that the question of disclosure did not arise.[27]The challenge to the Recorder’s approach to proportionality is likewise unarguable. On the evidence before her the Recorder carefully examined the steps taken by KCL in response to the appellant’s complaints and DSARs including its investigation into allegations of unauthorised access. She was entitled to conclude that the appellant’s requests were in part directed to a collateral purpose including their use in other proceedings and to take that matter into account in assessing both the utility of disclosure and the proportionality of the exercise sought. The Recorder’s assessment in this respect reflects the well-established principle that a data controller is required only to undertake searches which are reasonable and proportionate, not exhaustive.[28]Ground 3 alleges procedural irregularity and is also in my view without substance. The Recorder was not required to determine whether there had in fact been unauthorised access to the appellant’s accounts; rather the issue was whether KCL had complied with its statutory obligations. She was entitled to accept the evidence that KCL had conducted an extensive investigation into those allegations and found no supporting evidence. The remaining complaints under this ground amount to no more than a disagreement with the Recorder’s evaluative assessment of the evidence and her characterisation of the request made.[29]Ground 4, concerning the interpretation of section 167, is similarly unarguable. The Recorder correctly directed herself that a compliance order could only be made where an infringement of data subject rights had been established and that even in such a case the grant of relief remained a matter of discretion. She was entitled in exercising that discretion to consider the nature of the requests, their utility and the burden of compliance. The appellant’s contention that the Recorder improperly substituted her own view or took into account irrelevant considerations is not borne out by the judgment.[30]Further and in any event the Recorder made clear that even if there had been any breach, she would have refused to grant a compliance order on grounds of disproportionality. That constitutes an independent and sufficient basis for the decision which has not been shown to be arguably flawed.[31]As to ground 5, the challenge to the costs order discloses no arguable error of principle. It is well established that an appellate court will interfere only where there has been a misdirection or failure to take into account relevant considerations or a conclusion which is plainly wrong. The appellant identifies no such error; the complaint is in substance a disagreement with the Recorder’s assessment which is insufficient to found an appeal.[32]Standing back therefore, the respondent is correct to submit that the grounds amount to no more than an attempt to reargue the case advanced below. The Recorder rejected the appellant’s claim for multiple independent and properly reasoned grounds, each of which is sufficient to sustain the outcome. In those circumstances the appeal is bound to fail.[33]For those reasons and adopting the respondent’s submissions in this respect, I am satisfied that none of the grounds of appeal has any real prospect of success. The application for permission to appeal is therefore refused.[34]I am also satisfied that the application is wholly without merit, the applicable test is derived from CPR 23.12 and the authorities on when an application is to be certified as totally without merit. In short, an application is totally without merit if it is bound to fail. That formulation reflects the guidance in R Grace v Secretary of State for the Home Department [2014] 1 WLR 342 where the Court of Appeal explained that the question is whether the claim or application is so lacking in substance that it has no realistic prospect of success and no rational basis for proceeding. In practical terms therefore the Court is not merely asking whether the appeal is weak or unlikely to succeed on the ordinary permission test but whether it is incapable of succeeding on any reasonable view of the facts or the law. Where that higher threshold is met, as I conclude it is here, the Court must record that the application is totally without merit.[35]I am bound to consider whether a civil restraint order should be made in those circumstances. I do not consider at this stage that that would be appropriate. I therefore direct that this application be certified as totally without merit without taking any further step.[36]That concludes the judgment. End of Judgment. Transcript of a recording by Acolad UK Ltd 291-299 Borough High Street, London SE1 1JG Tel: 020 7269 0370 legal@ubiqus.com Acolad UK Ltd hereby certify that the above is an accurate and complete record of the proceedings or part thereof