Update on Kul v DWF – trial judgment

31 July 2025

We reported recently on the pre-trial review in Kul v DWF, and the trial judgment has now been handed down. All the claims were dismissed.

By way of brief recap: DWF produced a witness statement for use in personal injury proceedings that analysed a number of claims brought by a particular law firm to support the contention that other claims they had brought were fundamentally dishonest. Despite challenges, DWF were permitted to rely on that witness statement, as similar fact evidence, in the proceedings for which it was prepared. But individuals whose claims had been analysed in that witness statement then brought data protection claims against DWF – instructing, again, the same law firm as had acted in the earlier personal injury litigation. One of the unresolved questions at trial was how all of this was being funded, but answer came there none.

It’s fair to say that the evidence on behalf of the claimants was not especially satisfactory. The only person who gave evidence from the firm had no knowledge of matters other than what he had been told or shown by others, and when asked why he was giving evidence at all, said ‘I don’t know, I was asked to do so, I was paid to do so.’ The individual claimants were not necessarily wholly candid: one gave evidence through an interpreter, despite having a degree from an English university and being a qualified teacher in English as a second language. For all three claimants, Eady J was ‘left with a question whether [their] grievance has been encouraged in some way’, though prepared to accept they were genuinely aggrieved.

On the actual data protection issues, the processing was held to be justified on the basis of DWF’s obligation to act on its clients’ instructions and in their best interests (Art 6(1)(c) UK GDPR), and that it was acting in the public interest in ensuring the proper administration of justice (Art 6(1)(e)) and that it was pursuing its clients’ legitimate interests (Art 6(1)(f)). The crux of the claimants’ claim was that even if these were DWF’s motives, the processing was not necessary, was not fair and transparent, and that it involved processing of personal data beyond the purposes for which it was collected. Eady J rejected all of these arguments.

On necessity, the key issue was whether the claimants’ names needed to be used. On the facts, there was a justification for doing this, given the limitations of the data available, the likelihood of challenge to it, and that the data was being disclosed back to someone – the claimant’s law firm – who had been the original source of the information in question. Eady J took the view that this was a proportionate interference with the claimants’ rights and freedoms in the circumstances.

She also held that this was fair and transparent: there was no deceit or misleading by DWF, with the possibility of such use being foreshadowed in its privacy notice. There was minimal impact on the claimants: disclosure was back to their own law firm, with any other disclosure not being DWF’s responsibility. The concerns about the claims being encouraged were also taken into account here.

On purpose limitation, the restriction on that principle where the disclosure of data was necessary for the purposes of establishing, exercising or defending legal rights (paragraph 5(c) of Schedule 2 DPA) meant that this was a ‘bad point’.

The court did not go on to consider the issue, raised by DWF, of whether the claim was an abuse of process. It also did not consider – since the point was not taken – whether the use of material within an exhibit to a witness statement might not be covered by witness immunity.

Nonetheless, this is likely to stand as a helpful judgment for law firms and others involved in litigation: if you have considered what you are doing with personal data and why it is necessary, then there are a robust set of principles and exceptions which you are likely to be able to rely upon.

Further reading: Kul & ors v DWF LLP [2025] EWHC 1824 (KB)