Data subject access blunder
A London law firm has won a High Court injunction forcing a litigant to return thousands of confidential and privileged documents that were mistakenly disclosed following a data subject access request.
Forsters was acting for a married couple in a nuisance dispute with their neighbour, Zia Uddin, when it accidentally gave him access to large volumes of material that went far beyond the scope of his request.
The blunder arose after Uddin, who is defending a claim relating to alleged noise nuisance and interference with rights of way, submitted a DSAR seeking surveillance recordings, audio files and expert reports connected to the case.
Instead of receiving a limited set of documents, Uddin was sent a link, along with a username and password, that provided access to more than 3,300 files. These included around 800 documents from the firm’s client file, most of the material held on the case, as well as more than 2,000 documents from entirely unrelated matters dating back to 2009 involving other clients with the surname Uddin.
Uddin alerted the firm to the issue the following day, describing the disclosure as a serious breach. Forsters responded by explaining that the wrong data file had been sent inadvertently and asked him to delete the material in full.
When Uddin refused to do so, arguing that the documents were relevant to separate claims he was pursuing against the firm, Forsters applied to the High Court for an injunction.
Sitting as a deputy High Court judge, Guy Vassall-Adams KC accepted that the disclosure amounted to an obvious and serious mistake. He found that the vast majority of the documents were confidential and protected by legal professional privilege, while the remainder contained personal data relating to third parties.
“This is not only a case of ‘obvious mistake’,” he said. “[I]t is a case where the mistake involved so many documents and was so glaring and so obvious that the defendant, who is not legally qualified, wrote back to the claimant on 19 August 2025, one day after the documents were shared with him, condemning the claimant for a breach of confidence.”
The judge said it was understandable that an unrepresented party might want to rely on documents that appeared to assist their case, but stressed that privileged material was in a different category.
“The exceptionally strong public interest in members of the public being able to consult lawyers in confidence makes privileged documents an exception to the general rule that all relevant documents must be provided to the opposing party in litigation,” he said.
While Uddin might ultimately be entitled to some of the documents through disclosure or the DSAR process, the judge made clear that this was not a decision for him to take unilaterally.
“Notwithstanding that there is some confidential and privileged information that the defendant cannot un-know, so far as practicable, the court should strive to put the claimant back in the position that it would have been in had the obvious mistake not occurred,” the judge said.
The court ordered Uddin to deliver up all of the documents and delete any copies in his possession, noting that there was “no possible justification” for him to retain material wholly unrelated to the dispute.
