Info Gov

The Court of Appeal has dismissed an appeal brought by a litigant in person who challenged a High Court judge’s decision to transfer his data protection and human rights claim to the County Court, despite acknowledging procedural irregularities in the way the transfer was handled.

In Wysokinski v OCS Security Ltd [2026] EWCA Civ 26, Lady Justice Yip (with whom Bean LJ and Moylan LJ agreed) held that although the appellant should have been given an opportunity to make representations and the original order lacked adequate reasons, the transfer to the County Court was nonetheless “the inevitable outcome”.

Mr Pawel Wysokinski issued a claim in December 2024 in the Cardiff District Registry, alleging that a court security guard employed by OCS Security Ltd unlawfully disclosed details of a confiscated medical item to third parties. He brought claims under the UK GDPR and Data Protection Act 2018, and alleged breaches of Articles 6 and 8 ECHR. He valued the claim at £15,000–£30,000.

Because the claim was issued in a District Registry, CPR r.53.4 required the judge to transfer it either to the Royal Courts of Justice or to the County Court. On 31 December 2024, HHJ Jarman KC ordered transfer to the County Court without a hearing and without inviting submissions. The order also failed to include the mandatory notification that the parties could apply to set it aside under CPR 3.3(5)(b).

Mr Wysokinski sought reasons and attempted to apply for reconsideration, but his application was rejected as having been filed “in the wrong court” after the transfer had already taken effect. He appealed.

The Court of Appeal accepted that:
• the order should have included the CPR 3.3(5)(b) information;
• the appellant’s request for reconsideration should have been treated as an application;
• the judge should have provided brief reasons once reasons were requested; and
• the appellant acted promptly and reasonably.

Lady Justice Yip described the handling of the matter as “not the best use of resources”, noting that the appeal became the only route by which the appellant could obtain a reasoned decision.
However, these defects did not affect the correctness of the underlying decision.

The Court held that the claim was a straightforward data protection damages claim of modest value, well within the competence of the County Court. The claim form disclosed no complexity, no public interest element, and no need for a High Court judge.

The Court also considered additional material not before the judge below, including the respondent’s pre action correspondence admitting liability (subject to proof of a medical exemption certificate). The only remaining issues were factual and related to quantum.

Lady Justice Yip emphasised that:
• data protection claims “can and do proceed in the County Court”;
• the assessment of distress based damages is routine;
• the fact that the disclosure occurred during other legal proceedings did not elevate the complexity; and
• even if the appellant had been heard, the transfer decision “was inevitable”.

OCS Security sought more than £33,000 in appeal costs. The Court accepted that the appellant had not succeeded, but found the respondent’s costs disproportionate and noted that procedural errors below contributed to the appeal being pursued.

The Court ordered the appellant to pay a £5,000 contribution, enforceable only at the conclusion of the underlying claim and subject to set off against any damages awarded.

The appeal was dismissed. The Court reiterated that while procedural fairness matters, it will not overturn a decision that was substantively correct and inevitable.

Also in this section

May 26, 2026

Key Data Protection Issues for Automated Recruitment in the Public Sector

The need to recruit faster in a competitive market, the need to minimise costs in the recruitment process, and the need to secure the best candidate quickly, makes the use of AI an appealing option for any employer including public bodies. But there are pitfalls for the unwary write David Leach and Charlotte Smith.
May 08, 2026

Schools warned over AI blackmail threat as guidance urges rethink on pupil images

Schools across the UK are being urged to review or remove identifiable photographs of pupils from their websites and social media accounts, following warnings that criminals are using artificial intelligence tools to manipulate those images into child sexual abuse material (CSAM) and then threaten to release it unless a ransom is paid.
Apr 28, 2026

AI in Education: Why Data Protection Must Come First

Artificial Intelligence promises a lot. It can undoubtedly do amazing things. But secretly (or maybe not so secretly), it also makes us slightly nervous. Adam Halsey looks at what this means for schools, and why data protection needs to sit at the centre of any decision to use AI.
Apr 22, 2026

Preparing for the new complaints regime

From 19 June 2026, all organisations acting as data controllers are required to have in place an effective process to enable individuals to raise complaints about how their personal data is handled. Ashleigh Dibb looks at what this will mean in practice.
Apr 17, 2026

When data protection doesn’t protect you

Recently, the Information Commissioner’s Office published the outcome of a criminal prosecution. The title? Just two names: Christopher Munro and William Chipoma. No explanation. No softening. No anonymity. And that, in itself, is a powerful lesson in how data protection law really works.

InfoGov Masthead Newsletter 800