A routine legal battle spirals into a privacy nightmare as a firm fights to reclaim lost secrets
A High Court judge has ordered that more than 3,000 documents wrongly disclosed by a London law firm must be returned after the material was inadvertently sent to the opposing party in litigation.
Forsters LLP, acting for a couple pursuing a nuisance claim against their neighbour, Zia Uddin, mistakenly provided him with a large archive of emails when responding to a data subject access request (DSAR).
On 15 July 2025, Mr Uddin made a DSAR seeking surveillance recordings, audio files and expert reports related to noise nuisance allegations. The firm sent a URL link allowing him to access material. The following day, Mr Uddin informed the firm that the file contained a substantial volume of emails unconnected to his case.
The documents wrongly disclosed dated back to 2009 and arose from a keyword search on the name “Uddin,” pulling in material involving other clients of the firm. A sample review indicated that roughly 823 of the documents came from the Alloatti clients’ file, about 95 per cent of that bundle, while the remaining 2,500-plus files related to unrelated matters involving clients with the same surname.
Forsters acknowledged the error and asked Mr Uddin to destroy the file and permanently delete it. He refused, describing the firm’s demand as “improper” and asserting that the disclosure bore on his own claims of harassment and data misuse.
After Mr Uddin declined to return the documents, Forsters sought an interim injunction on the basis of breach of confidence, urging the court to order the delivery up of all confidential and privileged material disclosed by mistake.
Deputy High Court Judge Guy Vassall-Adams KC accepted that the disclosure constituted a “serious data breach” and ruled that the material should be returned. In his judgment, he emphasised that, so far as possible, the claimant should be returned to the position it would have been in had the mistake not occurred.
The judge noted that some of the information could not be “un-known” by Mr Uddin but said the court should nonetheless require delivery of all 3,300 documents in his possession. He added that there was no justification for the defendant to retain more than 2,000 confidential documents entirely unrelated to his own case.
Under UK law, privileged documents are generally considered a class apart. The court stressed that even if a privileged document was disclosed inadvertently, its retention or use by the receiving party is limited without the court’s permission.
Legal observers have described the case as an example of how an “obvious mistake” in responding to a DSAR can lead to injunctive relief to protect confidential and privileged material.
Forsters’ application for summary judgment in Mr Uddin’s separate claim against the firm, which includes allegations of harassment and misuse of private information, was ongoing at the time of the ruling.
The decision highlights the risks law firms face in handling extensive electronic records and the importance of robust processes for responding accurately to data subject access requests.