Forsters LLP – Court Ruling (United Kingdom, 2025)

Forsters LLP (the controller) is a firm acting on behalf of a couple involved in litigation with a neighbour (the recipient). On 15 July 2025 the recipient made an access request to the controller under Article 15 UK GDPR and asked for documents relevant to the main litigation proceedings. On 18 August 2025 the controller responded to the access request by including a link for accessing the requested information along with a user name and a password for downloading the files. The following day the recipient informed the controller that the email contained files unrelated to him and his case. The controller claimed an error led to the disclosure of the data and asked for the immediate erasure of the files. The recipient refused to comply with the request. The controller filed for an interim injunction seeking delivery up of confidential and privileged documents disclosed by mistake in response to the access request, citing the rights under Article 5(1) UK GDPR of affected data subjects. The court pointed out that there was no justification for the recipient to hold on to the confidential documents that were completely unrelated to his case and had been disclosed by mistake. Among others, the court rejected the claims that the compromised confidentiality of the documents should entitle the recipient to hold on to them. Instead, the court emphasised that it can help the controller regain control over the documents even if their confidentiality was compromised. Furthermore, the court rejected the argument that the documents might establish the truth in the main proceedings and thus the recipient should be allowed to use them. Instead, the court pointed out that the recipient would not have been aware of the contents of the documents without the accidental disclosure. Therefore, the court granted the interim injunction and ordered the recipient to deliver up all 3,300 documents in his possession, delete any copies he held and not use any information from the