Analysing case data across hundreds of files once meant a spreadsheet and a long afternoon. Tools now read the files themselves, and the volume rises to match. On 27 August 2026 the Court of Appeal ruled on what data protection law asks of that exercise, in Kul v DWF Law LLP [2026] EWCA Civ 1130. No artificial intelligence features in the case. The reasoning reaches it all the same, because the court examined the analysis rather than the machinery behind it.

What the firm did with the data

DWF acted for insurers defending a group of road traffic accident claims in which fundamental dishonesty was alleged. The insurers commissioned a review of 372 claims arising from accidents between 22 February 2016 and 1 March 2021, and in 367 of them the claimants were represented by the same north London firm. The review produced a spreadsheet naming each claimant, recording the medical evidence relied on and marking the features said to be suspect. James Stevens, a director and head of organised fraud at DWF, exhibited it to a witness statement on 18 June 2021 and served it on the other side.

The people named in that spreadsheet were not parties to the claims in which it was served. Their names, their injuries and the psychiatric evidence about them appeared in litigation that had nothing to do with them, and some of them sued.

How the claim ran

The action began with 127 claimants and reached trial with three, who sought declarations that DWF had processed their personal data unlawfully together with compliance orders under the Data Protection Act 2018. Eady J dismissed every claim on 22 July 2025. Warby LJ, giving the judgment of the Court of Appeal, dismissed the appeal in large part because the argument put to him had never been pleaded below. It rested on an authority nobody had cited and departed from a position the parties had agreed in front of the judge, and by the end of the hearing the only surviving contention, about a risk as to future processing, was described as a new, new case lying outside the case below. A firm defending work of this kind wins or loses on the record made at the time.

The test the court applied

DWF accepted that it had processed personal data, health information included, without anybody's consent. It relied on three lawful bases in article 6 of the UK GDPR, being compliance with a legal obligation, the public interest in the proper administration of justice, and the legitimate interests of its clients. For the medical material it relied on article 9(2)(f), which covers the establishment, exercise or defence of legal claims. That is the ordinary route through the UK GDPR for work done on the other side's information.

Everything turned on necessity, which in this context means more than desirable and less than indispensable, the formulation taken from Cooper v National Crime Agency. That imports a balance. Where a controller says its processing served a legitimate interest, the court asks whether the interest was legitimate and whether the data were processed for that purpose. It then asks whether the rights of the data subject take precedence, weighing their reasonable expectations against the scale of the processing and its effect on them.

The claimants said their names should have been replaced with file references from the start. The judge accepted DWF's explanation for keeping them, which was that its systems tracked accidents rather than individual claims, so names separated people injured in the same collision, and that names let the other side check the work. She found the balance fell in favour of the insurers, because people who supply information for litigation can expect opposing lawyers to scrutinise it, analyse it and read it out in open court. It counted too that the exercise was limited in scope and that DWF offered a pseudonymised version once the objection was raised.

What changes when a tool does the sorting

Put that same exercise inside a system that ingests the files and the legal test does not move. Three parts of it become harder to satisfy without preparation.

The first is the reason for holding identifiers. DWF gave evidence, from the person who built the analysis, of why names were needed at the moment they were used. A firm that loads whole files into a tool because whole files are what the tool ingests has no equivalent answer waiting, and the design of the software is not a lawful basis.

The second is scale, which the court treats as part of the balance rather than as a neutral fact. A review of 372 files sat comfortably within it. A tool ranging across every file the firm holds is a different proposition, and the interest relied on has to stretch that far.

The third is what happens when the reason falls away. DWF pseudonymised once the analysis had been tested and the need for names had gone, and that told in its favour. Software does not shed data on its own, and left alone it holds what it ingested for as long as the contract allows.

The confidentiality question sits next to this one

Firms run two questions together and then answer neither properly. Data protection asks whether you had a lawful basis for the processing. Confidentiality asks whether you were entitled to put the material where you put it, which is the ground the SRA warning notice of 17 August covers, and where material entering an open tool is treated as having gone into the public domain with privilege waived on upload. Kul answers the first question and says nothing about the second.

Before the next matter in which a tool reads across your files, write down the purpose, the lawful basis, why the work needs people identified, and the point at which it stops needing that, with a name against the task of acting on it. Read your privacy notice against those lines, because DWF's said in terms that information from opposing parties might be processed and disclosed, and the judge relied on it. A document most firms treat as furniture went into the balance on the firm's side.

The judgment is published as Kul v DWF Law LLP on the National Archives Find Case Law service, which is open to read and asks nothing of you.

If your firm is turning tools loose on its own case files, we set the purpose and the lawful basis before the first run: start with a conversation.