Yesim Kul & Ors v DWF Law LLP: Data protection compliance in multi-party personal injury claims

The High Court judgement delivered by the Honourable Mrs Justice Jennifer Eady DBE on 22 July 2025 in Yesim Kul & Ors v DWF Law LLP establishes important precedent regarding data protection obligations within personal injury litigation, particularly concerning the application of UK General Data Protection Regulation (UK GDPR) provisions to legal proceedings.

Case background and procedural history

The dispute originated from the processing of personal data relating to 137 claimants in road traffic accident claims. Following extensive discontinuances, three claimants (C1, C2, and C3) pursued their grievances against DWF Law LLP, which acted for multiple insurers. The claimants alleged that their data subject rights were infringed when DWF processed personal data derived from mass analysis of multiple claims, resulting in a document designated JS1.

The underlying concerns centred on claims submitted through Ersan & Co Solicitors, which represented numerous claimants in similar proceedings. In response to questions regarding the integrity of these claims, DWF conducted comprehensive data analysis across multiple cases, creating JS1, which contained specific personal information including names and health-related details. The disclosure of claimant identities within this document prompted the subsequent data protection challenge.

Legal framework and contested issues

The claimants contended that DWF's processing violated fundamental UK GDPR provisions, specifically Articles 5, 6, 9, 14, and 17, alleging breaches of legality, fairness, and transparency requirements. These allegations carried particular significance given the sensitive nature of the data involved, encompassing health-related information, with C2 being a minor at the relevant time.

DWF maintained that its processing was necessary for proper administration of justice and defending against claims of fundamental dishonesty. The firm argued that the data processing served legitimate interests in maintaining litigation integrity and supporting its clients' defensive positions.

Central to the dispute was the question of pseudonymisation. The claimants argued that their data should not have been included in JS1 without appropriate safeguards, raising fundamental questions about privacy rights within litigation contexts.

Judicial analysis and reasoning

Eady J examined the necessity and proportionality requirements governing personal data processing under UK GDPR. The court recognised that whilst the data processing served legitimate purposes, the absence of pseudonymisation raised significant considerations regarding data subject rights.

The judgement balanced competing interests: the legitimate need for data processing to ensure litigation integrity against individual privacy rights under data protection legislation. The court acknowledged DWF's processing was undertaken for legitimate reasons within the broader framework of ensuring legal proceedings' integrity and supporting the principle of open justice.

Decision and implications

The court dismissed the claimants' challenge, finding insufficient evidence that the data processing was unlawful. Eady J emphasised that the necessity of using personal data during litigation proceedings must be recognised, whilst acknowledging the critical implications for individual claimant rights under UK GDPR.

The judgement establishes that personal data processing within litigation contexts can be justified where necessary for proper administration of justice, even without extensive pseudonymisation, provided the processing serves legitimate interests and maintains proportionality.

This decision will likely influence data protection approaches in future personal injury litigation, establishing clearer parameters for legal representatives handling sensitive information within mass tort scenarios. The ruling clarifies the balance between data protection compliance and legitimate litigation interests, providing valuable guidance for multi-party personal injury proceedings involving extensive data processing requirements.