Summary
The usual problem for parties submitting a Data Subject Access Request (DSAR) is that they fail to extract all the information that they would like. This was turned on its head in Forsters LLP v Uddin [2025] EWHC 3255 (KB). The Defendant, Mr Uddin, made a DSAR to the Claimant. In response, the Claimant inadvertently disclosed over 3,000 documents to the Defendant - most of which were irrelevant to the Defendant - including privileged communications from the client’s file.
The Claimant successfully applied for an interim injunction in breach of confidence, seeking delivery of confidential and privileged documents which were disclosed to the Defendant in error.
Factual background
The Claimant acted for a couple, Mr and Mrs Alloatti, in litigation against the Defendant. The Claimant’s clients had issued proceedings against the Defendant in nuisance and for interfering with rights of way (the “Underlying Claim”).
On 15 July 2025, the Defendant made a DSAR to the Claimant seeking to obtain documents relating to the Underlying Claim. On 18 August 2025, the Claimant responded to the DSAR. On the following day, the Defendant responded by email to the Claimant, stating that the file sent contained a significant volume of documents unrelated to their case, involving third parties, the Claimant’s clients, and the Claimant’s colleagues. The file comprised of over 3,000 documents dating back to 2009.
Later that day, the Claimant sent the Defendant a letter by email, in which it stated that it had inadvertently provided access to the wrong data file, which the Defendant was not entitled to access or retain. The Claimant stated that the Defendant must immediately and permanently delete the file. The Defendant refused. The Defendant also refused the Claimant’s request that they provide undertakings relating to deletion and use of the documents.
Therefore, the Claimant applied for an injunction seeking orders for delivery or destruction of the documents disclosed in error and issued a Part 8 Claim for breach of confidence.
The Court’s analysis
The Court considered this was a case of “obvious mistake” and issued an injunction. This would aim to put the parties back into the positions they would have been in had the error not occurred.
Why do these mistakes happen? How can they be avoided?
In this case, the documents disclosed by the Claimant were considerably broader in scope than the DSAR request initially received. Such mistakes may arise as a result of various factors, including lack of training, inadequate data filtering methods, technological errors or hurried responses to requests. As DSARs increase, it increases the likelihood of erroneous disclosures, due to the volume of DSARs being dealt with.
To avoid accidental erroneous disclosure of irrelevant data in response to DSARs, data controllers should take careful note of any DSARs and their deadlines for response. They should review the scope of the DSAR and engage appropriate resource in handling the request well in advance of relevant deadlines. Data controllers should also consider whether further training in handling requests may be necessary. Ensuring that the correct documents are provided is key, so it advisable to sense-check documentation in terms of volume and time-periods covered, to ensure the disclosure appears correct.
Once they have happened, what can be done to minimise the impact?
Acting quickly following an erroneous response to a DSAR request is vital. This will ensure any erroneous disclosure is not spread any more widely than necessary. It may be possible to request an appropriate undertaking from the receiver of data. It may also be necessary to apply for injunctive relief, which should be applied for in a timely manner.
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.