# EWCA (UK) - 2026 EWCA Civ 1130

- Type: News
- Source: GDPRhub
- Date: 2026-09-02
- Original: https://gdprhub.eu/index.php?title=EWCA_(UK)_-_2026_EWCA_Civ_1130
- Canonical: https://overview.legal/posts/353650
- Topics: Special Categories of Data, Health Data, Personal Data, Types of Special Categories of Personal Data, Healthcare, Lawfulness, Controllers

## Summary

The Court of Appeal dismissed an appeal concerning the use of non-pseudonymised health data in litigation, finding that the claim concerning future processing was raised too late and lacked a factual basis.A court held that disclosing a spreadsheet containing information concerning a data subject’s injury claims in a court procedure constituted lawful processing of health data since it was necessary for the defense of legal claims. English Summary. English Summary . Facts Facts. Three persons wh

## Full text

The Court of Appeal dismissed an appeal concerning the use of non-pseudonymised health data in litigation, finding that the claim concerning future processing was raised too late and lacked a factual basis.A court held that disclosing a spreadsheet containing information concerning a data subject’s injury claims in a court procedure constituted lawful processing of health data since it was necessary for the defense of legal claims. English Summary. English Summary . Facts Facts. Three persons who had previously brought or been involved in personal injury claims arising from road traffic accidents, the data subjects, challenged the processing of their personal data by DWF Law LLP, the controller, which acted for insurers defending a wider group of personal injury claims in which fraud and fundamental dishonesty were alleged.Three persons who had brought personal injury claims arising from road traffic accidents and whose personal and health data were included in a spreadsheet prepared f

## Cited law provisions (6)

### GDPR — gdpr-art-6-par-1-pnt-c-en

processing is necessary for compliance with a legal obligation to which the controller is subject;

### GDPR — gdpr-art-6-par-1-pnt-e-en

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

### GDPR — gdpr-art-6-par-1-pnt-f-en

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

### GDPR — gdpr-art-9-par-2-pnt-f-en

processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

### GDPR — gdpr-art-25-par-1-en

Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.

### GDPR — gdpr-art-21-en

Right to object

---
Generated by overview.legal · https://overview.legal/posts/353650 · 2026-09-03