EWHC – KB-2025-003673

26 January 2026

Dt: Created page with “{{COURTdecisionBOX |Jurisdiction=United Kingdom |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=EWHC |Court_Original_Name=England and Wales High Court |Court_English_Name=England and Wales High Court |Court_With_Country=EWHC (United Kingdom) |Case_Number_Name=KB-2025-003673 |ECLI= |Original_Source_Name_1=BAILII |Original_Source_Link_1=https://www.bailii.org/cgi-bin/format.cgi?doc=/ew/cases/EWHC/KB/2025/3255.html&query=(GDPR) |Original_Source_Language_1…”

{{COURTdecisionBOX

|Case_Number_Name=KB-2025-003673
|ECLI=

|Date_Decided=11.12.2025
|Date_Published=
|Year=2025

|GDPR_Article_1=
|GDPR_Article_Link_1=
|GDPR_Article_2=
|GDPR_Article_Link_2=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|Initial_Contributor=
|
}}

A court ordered the delivery up of files accidentally disclosed to a litigating party after an access request, along with the erasure of the copies held and prohibition of future use.

== English Summary ==

=== Facts ===
Forsters LLP (the controller) is a firm acting on behalf of a couple involved in litigation with a neighbour (the recipient).

On 15 July 2025 the recipient made an access request to the controller under Article 15 UK GDPR and asked for documents relevant to the main litigation proceedings.

On 18 August 2025 the controller responded to the access request by including a link for accessing the requested information along with a user name and a password for downloading the files.

The following day the recipient informed the controller that the email contained files unrelated to him and his case.

The controller claimed an error led to the disclosure of the data and asked for the immediate erasure of the files. The recipient refused to comply with the request.

The controller filed for an interim injunction seeking delivery up of confidential and privileged documents disclosed by mistake in response to the access request, citing the rights under Article 5(1) UK GDPR of affected data subjects.

=== Holding ===
The court pointed out that there was no justification for the recipient to hold on to the confidential documents that were completely unrelated to his case and had been disclosed by mistake.

Among others, the court rejected the claims that the compromised confidentiality of the documents should entitle the recipient to hold on to them. Instead, the court emphasised that it can help the controller regain control over the documents even if their confidentiality was compromised.

Furthermore, the court rejected the argument that the documents might establish the truth in the main proceedings and thus the recipient should be allowed to use them. Instead, the court pointed out that the recipient would not have been aware of the contents of the documents without the accidental disclosure.

Therefore, the court granted the interim injunction and ordered the recipient to deliver up all 3,300 documents in his possession, delete any copies he held and not use any information from the documents in the main proceedings against his neighbours.

== Comment ==
”Share your comments here!”

== Further Resources ==
”Share blogs or news articles here!”

== English Machine Translation of the Decision ==
The decision below is a machine translation of the English original. Please refer to the English original for more details.

<pre>
[New search] [Context] [View without highlighting] [Printable PDF version] [Help]

Neutral Citation Number: [2025] EWHC 3255 (KB)

Case No: KB-2025-003673

IN THE HIGH COURT OF JUSTICE
KING’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST

Royal Courts of Justice
Strand, London, WC2A 2LL

11/12/2025

B e f o r e :

DHCJ GUY VASSALL-ADAMS KC
____________________

Between:

FORSTERS LLP
Claimant

– and

ZIA UDDIN
Defendant

____________________

Robin Hopkins (instructed by Clyde and Co Solicitors) for the Claimant
The Defendant appeared in person

Hearing date: 20 November 2025
____________________

HTML VERSION OF APPROVED JUDGMENT
____________________

This judgment was handed down at 10.30am on 11th December 2025 by a remote hearing conducted on Microsoft Teams and by release to the National Archives. ………………………..

DHCJ Guy Vassall-Adams KC :

This is an application for an interim injunction in breach of confidence seeking delivery up of confidential and privileged documents which were disclosed to the Defendant by mistake in response to a Data Subject Access Request (“DSAR”).

Factual background

The Claimant acts for a couple, Mr and Mrs Alloatti (the “clients”), who are involved in litigation with the Defendant. The clients and the Defendant are neighbours in Streatham in south-west London. On 9 June 2025 the clients issued proceedings against the Defendant in nuisance, relating to noise including dog barking from the Defendant’s property, and for interference with rights of way (the “Underlying Claim”). The claim was originally issued in the High Court but was transferred to the County Court on 31 July 2025.

On 1 August 2025, the Defendant issued a claim against two named employees of the Claimant firm, making allegations of harassment, breach of data protection rights and misuse of private information, among other things (the “Forsters Claim”). The Claimant denies those allegations and has applied for summary judgment and/or to strike out the claim (the “SJ Application”), which application is due to be heard on 18 December 2025 (the “SJ Hearing”).

On 15 July 2025 the Defendant had made a DSAR to the Claimant, pursuant to Article 15 GDPR and Schedule 2 to the Data Protection Act 2018. The DSAR sought to obtain from the Claimant surveillance recordings of his property, audio files regarding noises from his property, expert reports relating to the alleged nuisance and other documents relevant to the defence of the Underlying Claim.

On 18 August 2025 the Claimant responded to the Defendant’s DSAR by way of an email from the Claimant’s compliance manager. The email included a URL link for accessing the information, along with a user name and password, to enable the Defendant to download the documents.

The following day, 19 August 2025, the Defendant responded by email to the Claimant in the following terms (with words in bold retained from the original):

“I am writing to acknowledge receipt of your recent disclosure, specifically the .pst archive file. Upon review, it is clear this file contains a significant volume of emails wholly unrelated to my case, dating back to 2009. This correspondence involves third parties, clients of your firm and colleagues, representing a severe and indefensible breach of your professional and statutory duties. Serious and Unlawful Breaches Your disclosure constitutes a clear breach of multiple legal and professional obligations: • Breach of Confidentiality: You have disclosed privileged and confidential communications belonging to other clients who have no connection to these proceedings, in direct contravention of your professional duties. • Breach of Data Protection Law: The provision of personal data dating from 2009 onwards, without any lawful basis or relevance to this case, is a clear breach of the UK GDPR and the Data Protection Act 2018, particularly Articles 5(1)(a), (b), and (f).

• Procedural Abuse: The release of irrelevant and historic material highlights a fundamental failure in your disclosure process and demonstrates disproportionate conduct. This goes directly to the heart of the issues I have raised in my counterclaim and separate High Court claim. It also casts significant doubt on the integrity and reliability of all evidence you have placed before the Court.

Formal Notice and Required Action You are now formally on notice of this breach. I require urgent written confirmation of the following: • The circumstances under which this material was disclosed. • Whether you accept that the file contains confidential third-party and client material that is irrelevant to these proceedings. • Your immediate proposals for remedial action. If you contend that this disclosure does not constitute a breach, I require a full legal and factual basis for your position. If you maintain the material is irrelevant, you must confirm that it should never have been disclosed to me in the first place.” Later the same day, the Claimant sent the Defendant a letter by email in which it stated as follows (with words in bold retained from the original):

“As you have noted in your email sent at 05:28 on 19 August 2025, it has now come to light that KLDiscovery inadvertently provided access to the wrong data file. As a result, you were able to view and download a file containing the full set of keyword search results. This file includes material that is unrelated to you and/or the underlying matter, and which you are not entitled to access or retain. The correct data file, which you should have received, comprises only the personal data to which you are legitimately entitled. For the avoidance of doubt, the full set of data was disclosed to you in error. You are required to immediately and permanently delete the file in its entirety. We are of course happy to provide you with the correct DSAR disclosure link but we do require confirmation that the erroneously provided documents have been deleted.” The Defendant replied by email later the same day, in the following terms:

“Your demand that I “immediately and permanently delete the file is improper. The destruction of material evidence is contrary to the Overriding Objective. The disclosure itself is directly relevant to my claims of harassment and data misuse against your firm. I will preserve all evidence securely pending judicial or regulatory determination.” On 26 August 2025, the Claimant’s newly instructed solicitors, Clyde and Co, wrote to the Defendant asking him to give undertakings to delete and not to make any further use of the documents disclosed in error (the Documents) and advising him to take independent legal advice.

On 27 August 2025, the Defendant responded by email making it clear that he wished to use the Documents in the Underlying Claim and the Forsters Claim but that he would respect the confidentiality of solicitor-client correspondence and would continue to preserve the material securely.

Clyde and Co wrote to the Defendant again on 12 September 2025, seeking undertakings. The same request was repeated on 17 September 2025, making it clear that unless undertakings were provided the Claimant would commence proceedings. On each occasion they were rebuffed by the Defendant. On 17 September 2025, the Defendant replied in an email that:

“The disclosure data was produced by your client, Forsters LLP, acting as a data controller under the UK GDPR and Data Protection Act 2018. It contains my personal data and internal correspondence evidencing the handling of expert materials. This is not “Forsters Data”. It is evidence lawfully obtained under statutory rights.” On 7 October 2025, the Claimant issued the present application for an injunction, seeking orders for delivery or destruction of the Documents, and various related orders. The same day the Claimant issued a Part 8 Claim for breach of confidence.

The hearing on 28 November 2025

The application came before me on the afternoon of Friday 28 November 2025. The application was document-heavy, comprising a hearing bundle of 878 pages and an authorities bundle of 812 pages. At the end of the hearing I said that I was minded to grant the order sought and asked the Defendant if he would be prepared to give suitable undertakings to “hold the ring” until my reserved judgment was handed down. The Defendant agreed and I therefore invited the parties to agree the wording between themselves and rose for a few minutes to enable that to happen. The Defendant subsequently gave an undertaking to the court, in a form approved by the Claimant, that he would not make any use of the Documents until I had handed down my reserved judgment. I am grateful to the Defendant for his sensible cooperation in this regard.

The Documents

The nature of the Documents is addressed in the witness statement of Ms Dewar dated 7 October 2025. In total, about 3,300 documents were provided to the Defendant. The documents included 823 documents from Mr and Mrs Alloatti’s file, which comprises about 95% of that file. Ms Dewar gives an overview of the kinds of documentation in the file, including emails between the Claimant and their clients; emails between the Claimant and Counsel instructed in the underlying dispute; advice from Counsel in that dispute; draft pleadings; emails between the Claimant and experts; documentary evidence in relation to the claim; fee notes and fee estimates and internal emails. I accept Ms Dewar’s evidence that most of the documents in the Alloatti file are both confidential and protected by legal professional privilege, while the documents that are not privileged are in any event likely to be confidential.

The remaining files, which constitute a majority, are almost exclusively files relating to other clients of the Claimant who have no connection with the underlying dispute or with the Defendant. Ms Dewar’s evidence is that the documents were responsive to the search term “Uddin”, but this is apparently quite a common surname and so picked up documents dating back to 2009 relating to clients with this name. The Claimant has not done an exhaustive analysis of these documents, but there is a table showing a sample of these documents. These documents involve the processing of the personal data of a number of third parties. They are not generally of a high level of sensitivity based on this sample, but I consider that all of these documents contain personal data about third parties and in many cases the documents would also be classed as private or confidential.

The Defendant’s Use of the Documents

On 20 August, one day after the first exchange of emails in which the Claimant sought undertakings to delete the Documents and he refused to give them, Mr Alloatti’s employer Federated Hermes received three emails from an anonymous email address, justicewithai@protonmail.com. One of these emails provides details about Mr Alloatti’s involvement in the Underlying Claim and media publicity about the case. Two further emails received the same day related to an allegation about Mr Alloatti having paid his legal fees from his employer’s bank account (which is denied). Three further emails were sent from the same email address on 26 August 2025, 28 August 2025 and 14 September 2025, with the latter providing a link to the Defendant’s LinkedIn page.

The Claimant points to a number of suspicious features of the Proton emails and invites me to conclude that there are reasonable grounds to suspect that the Defendant is behind them. These are: the timing of the emails coming only 2 days after the Documents were inadvertently disclosed to the Defendant; in some cases the emails reference information which the Claimant says is not in the public domain but is in the Documents (a sum paid to counsel, a Ramsgate address, the Defendant’s ownership of a vintage camper van); the inclusion of a link to the Defendant’s LinkedIn posts, which looks like an attempt to publicise those posts to the Claimant’s employer. The Defendant denies being behind the Proton email address.

What is clear and undisputed is that the Defendant seeks to made use of some of the Documents. On 1 September 2025 he wrote to the Claimant stating that he intended to prepare and serve amended Particulars of Claim in his claim against the Claimant, which is the subject of the coming strike out and summary judgment application. The Defendant informed the Claimant that the court’s permission was required for any such amendments and I understand that the Defendant has not pursued this course.

However, on 8 October 2025 the Defendant sent the Claimant’s solicitors a witness statement dated 7 October 2025 in response to the SJ Application. The exhibit bundle refers to privileged communications between Mr and Mrs Alloatti and the Claimant discussing the underlying claim, together with internal correspondence belong to the Claimant. It also extracts privileged communications between Counsel in the underlying dispute and the Claimant, discussing prospects of success in the Underlying Dispute and general strategy.

On 10 and 16 October 2025, the Defendant sent the Claimant two further witness statements exhibiting confidential and privileged communications concerning the underlying dispute which the Defendant proposes to deploy at the summary judgment hearing. I understand that these witness statements and exhibits were also filed by the Defendant on CE File.

Legal framework

Confidential information

A duty of confidence may arise in equity in the circumstances described by Lord Goff in his judgment in AG v Guardian Newspapers 1 AC [1990] 1 AC 109 p281, namely “when confidential information comes to the knowledge of the person (the confidant) in circumstances where he has notice, or is held to have agreed, that the information is confidential, with the effect that it would be just in all the circumstances that he should be precluded from disclosing the information to others.”

In these circumstances, the Court has a wide range of powers in equity to compel the return of confidential information. The Court of Appeal’s judgment in Imerman v Tchenguiz [2010] EWCA Civ 908 is a key reference point for the range of the court’s powers in such situations. The facts in that case were different from this one. That was a case of a person deliberately accessing confidential documents on someone else’s computer. Privileged documents were not involved because the documents improperly obtained were then reviewed by counsel who removed the privileged documents. However, the statements of principle about the court’s powers in equity in that case are of general application.

The Court of Appeal reviewed a large number of previous authorities about the court’s powers in equity to compel the return of confidential and/or privileged documents, including such well-known cases as Prince Albert v Strange 1 Mac & G 25, Lord Ashburton v Pape [1913] 2 Ch 469 and ITC Film Distributors v Video Exchange Limited [1982] Ch 431 as well as more recent case law on the law of confidence generally.

The Court of Appeal summarised the position at [69]:

“In our view, it would be a breach of confidence for a defendant, without the authority of the claimant, to examine, or to make, retain, or supply copies to a third party of, a document whose contents are, and were (or ought to have been) appreciated by the defendant to be, confidential to the claimant. It is of the essence of the claimant’s right to confidentiality that he can choose whether, and, if so, to whom and in what circumstances and on what terms, to reveal the information which has the protection of the confidence. It seems to us, as a matter of principle, that, again in the absence of any defence on the particular facts, a claimant who establishes a right of confidence in certain information contained in a document should be able to restrain any threat by an unauthorised defendant to look at, copy, distribute any copies of, or to communicate, or utilise the contents of the document (or any copy), and also be able to enforce the return (or destruction) of any such document or copy. Without the court having the power to grant such relief, the information will, through the unauthorised act of the defendant, either lose its confidential character, or will at least be at risk of doing so. The claimant should not be at risk, through the unauthorised act of the defendant, of having the confidentiality of the information lost, or even potentially lost.”

Privileged information

Solicitors are under a duty to keep their client’s affairs confidential. As Lord Millett put it in Prince Jefri Bolkiah v KPMG [1999] 2 WLR 215: “Whether founded in contract of in equity, the duty to preserve confidentiality is unqualified. It is a duty to keep the information confidential, not merely to take all reasonable steps to do so.” This is reflected in the Solicitor’s Regulation Authority guidance on the duty of confidentiality.

The Courts have frequently been called upon to consider what should be done when documents that are confidential and privileged to one party in litigation have found their ways into the hands of the opposing party. In some cases this has been because one party to litigation did something improper to get access to confidential and/or privileged information that they were not entitled to. Lord Ashburton v Pape [1913] 2 Ch 469, ITC Film Distributors v Video Exchange Limited [1982] Ch 431 and Imerman v Tchenguiz [2010] EWCA Civ 908 are cases concerning improper access.

Another situation is where confidential and privileged documents are disclosed to the opposing party inadvertently. This typically happens when something goes wrong in a disclosure exercise. The touchstone of whether the court will intervene in the situation of inadvertent disclosure of confidential and privileged documents to an opposing party in litigation is whether the receiving party is taking advantage of an “obvious mistake”. In that situation, the Courts will generally compel the return of any confidential and privileged information: Derby and Co v Weldon [1991] 1 WLR 73.

CPR 31.20 provides that where a party inadvertently allows a privileged document to be inspected, the party who has inspected that document may use it or its contents only with the permission of the court. That provision does not apply here in relation to a DSAR response, but Mr Hopkins says that the principles under CPR 31.20 broadly reflect the law’s policy in this area that one party should not be able to take advantage of another party’s mistake in a disclosure process.

The case law on “obvious mistake” is summarised in the judgment of the Court of Appeal in Fayed v Commissioner of Police of the Metropolis [2002] EWCA Civ 780 by Clarke LJ at [16]:

“In our judgment the following principles can be derived from those cases:

i) A party giving inspection of documents must decide before doing so what privileged documents he wishes to allow the other party to see and what he does not. ii) Although the privilege is that of the client and not the solicitor, a party clothes his solicitor with ostensible authority (if not implied or express authority) to waive privilege in respect of relevant documents. iii) A solicitor considering documents made available by the other party to litigation owes no duty of care to that party and is in general entitled to assume that any privilege which might otherwise have been claimed for such documents has been waived. iv) In these circumstances, where a party has given inspection of documents, including privileged documents which he has allowed the other party to inspect by mistake, it will in general be too late for him to claim privilege in order to attempt to correct the mistake by obtaining injunctive relief. v) However, the court has jurisdiction to intervene to prevent the use of documents made available for inspection by mistake where justice requires, as for example in the case of inspection procured by fraud. vi) In the absence of fraud, all will depend upon the circumstances, but the court may grant an injunction if the documents have been made available for inspection as a result of an obvious mistake. vii) A mistake is likely to be held to be obvious and an injunction granted where the documents are received by a solicitor and: a) the solicitor appreciates that a mistake has been made before making some use of the documents; or b) it would be obvious to a reasonable solicitor in his position that a mistake has been made; and, in either case, there are no other circumstances which would make it unjust or inequitable to grant relief. viii) Where a solicitor gives detailed consideration to the question whether the documents have been made available for inspection by mistake and honestly concludes that they have not, that fact will be a relevant (and in many cases an important) pointer to the conclusion that it would not be obvious to the reasonable solicitor that a mistake had been made, but is not conclusive; the decision remains a matter for the court. ix) In both the cases identified in vii) a) and b) above there are many circumstances in which it may nevertheless be held to be inequitable or unjust to grant relief, but all will depend upon the particular circumstances. x) Since the court is exercising an equitable jurisdiction, there are no rigid rules.” Privileged documents are a class of confidential document to which special considerations apply. Unlike in relation to confidential documents generally where the court may engage in a balancing exercise against any countervailing public interest that a defendant may advance for being allowed to use a document in a particular way, the rules governing the law of privilege are premised on the ability of a one party to withhold privileged documents from the opposing party, no matter how relevant they may be to the dispute between them and no matter that they may show “the truth” (or what one party regards as the truth). Because the balance has already been struck in favour of non-disclosure, courts have frequently taken the view that in relation to privileged documents the court has no discretion to refuse the relief sought when is it is exercising the Ashburton v Pape jurisdiction. As May LJ observed in Goddard v Nationwide Building Society [1987] QB 670:

“ once it is established that a case is governed by Lord Ashburton v Pape [1913] 2 Ch 469 there is no discretion in the court to refuse to exercise the equitable jurisdiction according to its view of the materiality of the communication, the justice of admitting or excluding it or the like. The injunction is granted in aid of the privilege which, unless and until it is waived, is absolute.” In Istil Group v Zahoor [2003] EWHC 165 (Ch), [2002] 2 All ER 252, after reviewing the relevant authorities Lawrence Collins J held at [93] that, “In this context, the emergence of the truth is not of itself a sufficient public interest. The reason why the balancing exercise is not appropriate is because the balance between privilege and truth has already been struck in favour of the former.” This passage was cited with approval by the Court of Appeal in Lachaux v Independent Print [2017] EWCA Civ 1327, [2018] EMLR 2 (Davis LJ, with whom Sharpe LJ and Macfarlane LJ agreed), where the claimant successfully obtained an injunction preventing the newspaper from relying on a privileged document supplied by the claimant’s former spouse by which it sought to challenge part of the claimant’s evidence. Lachaux reaffirmed that the only exception would be where one party could show that the documents had come into existence for the furtherance of fraudulent conduct.

As a precondition for privilege is that the information in question is confidential, confidence and therefore privilege may be lost if the information becomes public in a way and/or to a degree that undermines the confidentiality of the information. This is an acutely fact-sensitive question. Here it is not contended by the Defendant that any of the Documents have entered the public domain in this sense. However, the Defendant has exhibited a number of confidential and privileged documents to his witness statements in response to the Claimant’s SJ Application, so it seems likely that at least some of the Documents will become public if the Defendant is allowed to deploy them at the public hearing listed for 18 December 2025.

Argument

In summary, the main arguments for the parties were as follows. Mr Hopkins for the Claimant submitted that this is an “obvious mistake” case, albeit one that arose in response to a DSAR request and not as part of a disclosure exercise. He submitted that the Defendant was not entitled to receive the Documents, the vast majority of which are confidential and/or subject to the LPP rights of the clients of the Claimant. He submitted that the Defendant’s initial response after receiving the Documents showed that this was an “obvious mistake”. He also emphasised that the inadvertent disclosure of the Documents and the Defendant’s retention and use of their contents contravenes the rights of a range of data subjects under Article 5(1) UK GDPR. Without granting the injunctive relief sought by the Claimant, the persons whose information is contained in the Documents are exposed and will remain exposed to very significant prejudice. By way of contrast, granting an injunction would not cause any unwarranted prejudice to the interests of the Defendant; his interests can be catered for through the normal disclosure and DSAR process.

The Defendant made the following submissions in response, albeit not in this order. First, he argued that the disclosure was not a mistake, but a lawful DSAR response. The Claimant chose their own disclosure platform provider and they can’t now say what happened is an error just because it embarrasses them. Secondly, I should refuse to grant relief to the Claimant because of its delay in applying for an injunction. Thirdly, the Claimant had improperly failed to identify all of the 3,300 documents and so I could not be satisfied that they are all confidential and/or privileged. Fourthly, there is no evidence of dissemination on his part and he has no intent to misuse them. Mere possession is not a misuse. Fifthly, he argued that the orders the Claimant is seeking (orders for delivery up, destruction of documents, prohibition on future use) are not orders which can be granted as interim relief, only as final relief. Sixthly, he argued that once information was in the public domain it couldn’t be confidential. Finally, he argued that he should be allowed to use the Documents solely for the purpose of the two claims in order to establish the truth.

Analysis

This is not only a case of “obvious mistake”; it is a case where the mistake involved so many documents and was so glaring and so obvious that the Defendant, who is not legally qualified, wrote back to the Claimant on 19 August 2025, one day after the Documents were shared with him, condemning the Claimant for a breach of confidence. His precise words were, “You have disclosed privileged and confidential communications belonging to other clients who have no connection to these proceedings, in direct contravention of your professional duties.” He also criticised the Claimant for disclosing personal data that had no relevance to his case, in breach of the GDPR. He stated that, “The release of irrelevant and historic material highlights a fundamental failure in your disclosure process”.

It is hard to fault the Defendant’s legal analysis. The Documents accidentally provided to him in response to his DSAR are confidential and in many instances also privileged. They comprise about 95% of the Alloatti client file in the Underlying Claim i.e. almost everything. The evidence of Ms Dewar clearly shows that a wide range of confidential and privileged documents have been handed over, including advices from counsel, draft pleadings, communications with experts and emails between the Claimant and its clients. I accept the Claimant’s evidence that the vast majority of the Alloatti client file documents are likely to be privileged to those clients. In addition, there are numerous other documents that don’t relate to the underlying dispute at all but concern other cases which happened to involve clients who share the surname Uddin. These documents contain a lot of third party data and engage some confidentiality and privacy interests, albeit that the sample I have seen suggests the information is of a much lower order of confidentiality than the Alloatti client file.

Unfortunately, in spite of his initial, correct assessment of the situation, the Defendant very quickly managed to persuade himself that he was entitled to hold on to the Documents. Later on 19 August 2025, responding to the Claimant’s first letter demanding deletion of the Documents, the Defendant started making assertions that he should be allowed to retain them and to use them for his own purposes. The Claimant gave him several opportunities to give appropriate undertakings, but the Defendant refused to provide them. Instead, the Defendant seeks to use some of confidential and privileged documents in the Forsters Claim, exhibiting them to witness statements that he wishes to deploy at the SJ Hearing.

The Claimant also alleges that the Defendant tried to use information from the Documents in emails from an anonymous Proton email address which were sent to the Claimant’s employer on 20 August 2015. I accept that the circumstances have some suspicious features but in view of the fact that the Defendant is clearly trying to use the Documents in the Underlying Claim and the Forsters Claim I do not find it necessary to make any finding on this issue.

The starting point is that ordinarily where a party to litigation discloses documents to the opposing party which are confidential and privileged and the court is satisfied that it is a case of “obvious mistake”, which was either known to or ought to have been known to the receiving party, the Court will intervene by injunction to, so far as possible, put the parties back into the position they would have been had the error not occurred. This will usually involve granting an injunction that requires the recipient to deliver up the documents, to destroy any copies of he has made of them and which restrains him from making any use of the information contained in the documents.

The Defendant advances a number of arguments as to why he should not be compelled to return the Documents. At the hearing, the Defendant put his arguments in a clear, concise and polite way and I will address each of them.

His first argument is that the Documents were lawfully disclosed to him pursuant to his DSAR and he is entitled to retain them. That is not correct as the Defendant knows very well I refer him to his own email dated 19 August 2025 which accurately summarises the position. The Defendant knew, from the outset, that this was not his DSAR response but a serious data breach.

Secondly, the Defendant relies on delay. I agree with the Defendant that it is surprising that the Claimant having realised its error on 19 August 2025, took until 7 October 2025 to bring proceedings and seek an injunction. The Claimant says in response that they were trying to persuade the Defendant to do the sensible thing and to give suitable undertakings without the need for court proceedings. However, given that on 19 August 2025 the Defendant was already pushing back against the demand that he should return the Documents it might be said the warning signs were there from the beginning. Furthermore, on the Claimant’s case, the Defendant was misusing the Documents by 20 August 2025 (the Proton email issue).

However, even though I consider the Claimant could and should have acted much more swiftly the delay here is not such as to undermine the Claimant’s ability to claim equitable relief, as the merits overwhelmingly favour the Claimant, the claim remains a strong one and nothing has happened during the period of the delay to undermine the claim in any significant way. However, I may decide to take delay into account on the question of costs.

Thirdly, the Defendant argues that the Claimant’s case is evidentially flawed because it has not done a document-by-document analysis and instead relies on categories of documentation. In my view it would be wrong and disproportionate to require claimants in such situations to examine all of the 3,300 documents individually and to provide information about each of their contents. The Claimant’s evidence sensibly describes the privileged documents in general terms, not least because it avoids further undermining the privileged status of the documents by providing too much information about their contents. The approach that the Claimant has taken to the confidential documents of accessing a sample of them gives an overview of the kinds of document involved, which is all that is required in this sort of situation. The Defendant’s approach would have added greatly to the costs involved for little tangible benefit.

Fourthly, the Defendant argues that this is a mere possession situation and there is no evidence he has any intention to misuse the documents. There is a legal and a factual answer to this submission. As to the law, mere retention by B of A’s confidential information without lawful authority is itself a breach of confidence and sufficient for the purpose of A seeking equitable relief against B to regain control over that information: Imerman v Tchenguiz [2010] EWCA Civ 908 at [72]; Chief Constable of Kent v Taylor [2022] EWHC 737 (QB) at [54(2)]. Secondly, I don’t accept that this is a mere possession case the Defendant is trying to use the Documents in the Underlying Claim and the Forsters claim and I believe he will continue to do so unless restrained by injunction.

Fifthly, the Defendant has argued that the Claimant is not seeking interim relief but final relief and on that basis it should be refused. This represents a misunderstanding on the Defendant’s part. The Claimant is seeking interim relief in these proceedings but it is not at all unusual in privacy and confidence cases for the interim relief to sometimes be dispositive of the claim, particularly where a party is only seeking injunctive relief and is not pursuing a claim for damages. I reject the Defendant’s argument that the Claimant is somehow misusing the Court’s process.

Finally, he made two arguments which seem to me to be the most substantial in this case. First, he argued that the Documents have entered the public domain. When I sought to clarify this argument with him it became clear that he is not contending that the Documents have become so publicly available as to destroy their confidentiality, but that their erroneous disclosure to him has undermined the confidentiality and privilege in the information he has seen. Secondly and relatedly, he wishes to be able to use the Documents for his claims.

I agree that the confidentiality and privilege of the information in the Documents has been compromised by reason of its inadvertent disclosure to the Defendant. There is some confidential and privileged information which the Defendant has seen and which he cannot un-know e.g. the contents of counsel’s advice to the clients. To this extent the genie cannot be put back into the bottle, at least not completely. Nonetheless, the court can help the Claimant to regain control over the 3,300 documents themselves and over the way in which information from those documents is deployed in the two claims. In this way, the court can remedy most of the mischief which this inadvertent disclosure has caused.

The Defendant argues that he should be able to make use of the Documents insofar as they are relevant to the two claims. The Defendant argues that relevant documents will help him to establish the truth and that in these circumstances it would be unjust to prevent him from using them.

It is understandable that an unrepresented party who receives privileged documents from an opposing party to litigation and who sees that they might help his case would wish to be able to use them to his advantage. In a normal disclosure situation, one party would be required to disclose the existence of relevant documents which would support the opposing party’s case even if they are confidential – so it is easy to see why a layperson might assume the same is the case even if the documents are privileged.

But privileged documents are a class apart. It is in the very nature of the right of privilege that a party may properly withhold from disclosure a document that is highly relevant to a case if it is privileged. In this respect, the law has already struck the balance between privilege and truth in favour of privilege. The exceptionally strong public interest in members of the public being able to consult lawyers in confidence makes privileged documents an exception to the general rule that all relevant documents must be provided to the opposing party in litigation.

This is why the courts have consistently held that it is no answer to a claim for delivery up of privileged documents that they might establish the truth as the receiving party sees it. The Defendant would never have been aware of the contents of any of these privileged documents were it not for the Claimant’s obvious mistake. To the greatest extent practically possible, the Claimant should be put back in the position it would have been in had this obvious mistake not occurred.

In principle some of the confidential (but not privileged) documents relating to the Underlying Claim or the Forsters Claim may fall to be disclosed as part of standard disclosure in those claims. Equally, the Defendant may be entitled to some of this information through his DSAR (which the Claimant understandably has held back pending the determination of this application). Under the CPR, it is the disclosing party who is tasked with making the assessment as to which documents are relevant and fall to be disclosed. The same is true in relation to data controllers and DSARs. The right course is to require the Claimant to deliver up these documents so that the Claimant can discharge its legal obligations in the usual way, under the control of the Court.

The Defendant also has well over 2,000 confidential documents which are wholly unrelated to his case. There is no possible justification for the Defendant to hold on to these, as he appeared to concede in his initial response on 19 August 2025. The Claimant should be able to regain control of all of these documents on behalf of its clients whose personal data and confidential information has been compromised in this way.

Conclusion

For all of these reasons, I am satisfied that the Claimant should be granted the injunctive relief that it seeks. This is a very clear case of obvious mistake. Notwithstanding that there is some confidential and privileged information that the Defendant cannot un-know, so far as practicable, the court should strive to put the Claimant back in the position that it would have been in had the obvious mistake not occurred. In practical terms this means that the Defendant must deliver up all the 3,300 Documents in his possession, must delete any copies that he holds of the Documents and will be injuncted against using the Documents or any information from the Documents, in the Underlying Claim and the Forsters Claim.
</pre>

ICO (UK) – ZMLUK Limited

IMY (Sweden) – IMY-2025-7801