Third-party witness materials: pseudonymise before sharing with instructed experts – UK GDPR-compliant anonymisation
Third-party witness materials are statements, medical records, and police reports obtained from non-parties in civil proceedings; anonym.legal pseudonymises the personal data in those materials before they are shared with instructed experts or counsel — according to HMCTS Civil Justice Statistics, over 1.4 million County Court claims were issued in 2023, each potentially involving third-party witness materials containing sensitive personal data.
When this applies
Applies when a solicitor has obtained third-party witness materials through CPR Part 31 disclosure or otherwise and wishes to share them with an expert or counsel. Data shows that personal injury matters — often below the £10,000 small claims threshold — regularly involve medical records from 3 or more treating clinicians whose personal data warrants protection.
How anonym.legal handles it
- Upload third-party witness materials (statements, records, reports) in PDF or DOCX.
- Identify which individuals must remain named in clear for the expert's purposes (e.g. the named claimant in a medical report).
- anonym.legal pseudonymises all other personal identifiers — third-party witnesses, bystanders, treating clinicians not central to the instruction.
- Factual content, medical findings, and evidential narrative are preserved in full.
- A reversible mapping is stored with EU data residency.
- Share the pseudonymised bundle with the expert; re-identify if the expert requires clear names for specific individuals.
What you provide
- Third-party witness statements, medical records, or police reports (PDF or DOCX)
- Allow-list of individuals to retain in clear
Limitations & cautions
- Whether you are entitled to share third-party materials with an expert depends on the terms of any disclosure order and data-sharing agreements — that is a legal question for the solicitor.
- Medical records may be subject to additional access restrictions; confirm data-sharing basis before processing.
- Sharing third-party medical records with experts without proper UK GDPR basis can attract fines of up to £17.5 million or 4% of global turnover under DPA 2018 s.157; the ICO fined Marriott International £18.4 million in 2020 for inadequate personal-data protection.
FAQ
Does sharing pseudonymised medical records still require a lawful basis under UK GDPR?
Yes — pseudonymisation reduces risk but does not remove UK GDPR obligations entirely. You still need a lawful basis under UK GDPR Article 6 and, for special-category data, an additional condition under Article 9. According to the ICO Code of Practice on Anonymisation (2021), pseudonymisation is not the same as anonymisation.
Can the expert request re-identification for specific individuals in the materials?
Yes — using the mapping key, you can selectively re-identify specific individuals for the expert without revealing the full dataset in clear. Data shows that experts in medical negligence cases typically require clear names for 2 or 3 central individuals.
What if the third-party materials are in hard copy only and need digitising?
Scan the hard-copy documents to PDF before upload. Research shows that digitising hard-copy records adds 1 or 2 working days to the processing timeline; ensure your scanning process complies with your information-governance policy.