[2024] UKUT 105 (AAC)

The logical starting point, when addressing the overarching aspects of Ground 1, is to consider whether we accept Mr Pitt-Payne’s submission that the FTT entirely failed to address the requirement of transparency imposed by Article 5(1)(a) GDPR in reaching their conclusions. The high-point of this submission is the FTT’s statement in [175] of their decision that, “The relevant transparency requirement here is the requirement to provide an article 14 notice...” and the absence of any express reference to Article 5(1)(a) in their conclusions section headed “Has there been a breach as the Information Commissioner submits?”.

We have already explained that Article 5(1)(a) is the source of the overarching transparency principle and that it may require steps to be taken that go beyond the specific requirements of Articles 13-14 ([95] above). The contraventions identified in the Information Commissioner’s EN included Article 5(1)(a) as well as Article 14 ([13]-[18] above). Accordingly, we accept that it was incumbent on the FTT to consider whether the Article 5(1)(a) requirement of transparency had been met in this instance.

However, the absence of express reference to Article 5(1)(a) in the conclusions section of the FTT’s decision is not determinative. As we explained when setting out the applicable legal framework, we need to consider the decision in light of the evidence and submissions that were before the FTT and the inferences that we can properly draw as to the basis upon which they reached the decision that, absent the residual cohort, there were no material contraventions of the GDPR.

In this regard, it is important to appreciate that the parties were agreed that the alleged contravention of Article 5(1)(a) related to the content and layout of the CIP, whereas the alleged contravention of Article 14 concerned the user journey to the CIP ([30] above). We say this because there can be no doubt that the FTT did address the content and layout of the CIP, finding at [177] that “having consider the CIP in detail, that in its current form, as provided to us, it is adequately clear...we consider that the relevant information is sufficiently prominently displayed and accessible to data subjects who want to understand how their data will be processed”. We are not at this stage concerned with the specifics of how the FTT addressed the layering of the website; that is the subject of Ground 3. We are simply focusing upon whether the FTT considered the Article 5(1)(a) transparency principle at all or whether they confined their reasoning and conclusions to Article 14. These passages in [177] indicate that the FTT did consider Article 5(1)(a) in substance and reached conclusions as to whether the content and layout of the CIP met the requirements of transparency.

We are reinforced in this view by the features that we go on to list in this paragraph, which all indicate that the FTT was alive to the significance of Article 5(1)(a) and the transparency principle. Article 5(1)(a) clearly featured in the parties’ written submissions to the FTT. The FTT’s decision included a lengthy summary of the EN and the sub-heading above their summary of the Category A requirements was, “Category A: Fair and Transparent Processing Article 5(1)(a)” and their summary of the Category C requirements was sub-headed, “Category C: Lawful Processing: Article 5(1)(a) and Article 6(1)”. The FTT’s summary of the Information Commissioner’s response to Experian’s grounds of appeal also included reference to Article 5(1)(a), for example at [51] of their decision. When they came to setting out the legal framework, the FTT set out the material parts of Article 5(1) at [116]. In the same paragraph they said that they had also taken into account the various recitals to the GDPR “to which we have been referred as an aid to interpretation”. We understand that these recitals were the same recitals as Mr Pitt-Payne cited to us concerning the principle of transparency (and set out at [84]-[88] above). At [119] of their decision, the FTT accepted the Information Commissioner's submission that the right to transparency in the processing of personal data was foundational. At [121] of their decision the FTT rightly said that the level of transparency required will be fact-specific and context-related. The FTT’s summary of the Information Commissioner's case indicates that they were aware that the argument had not become confined to the user route to the CIP; at [135] the FTT correctly recognised that the core of the Information Commissioner’s submissions was that the processing undertaken by Experian will be surprising to those whose personal data is being processed and that the process was intrusive; and at [164] the FTT noted that the Information Commissioner’s case was that Experian had made “no attempt to identify the information that individuals were likely to find concerning or surprising and did not address its mind to the questions of what steps it should take to ensure the information was promptly located in the CIP”.

Furthermore, whilst our reasoning does not depend on this point, we consider that the FTT’s comment at [175] of their decision to “the relevant transparency requirement here is the requirement to provide an article 14 notice” (which Mr Pitt-Payne emphasised to us) needs to be placed in its context. It was said immediately after the FTT’s reference in [174] to the fourth ground of Experian’s grounds of appeal, which was centred on Article 14 and the alleged disproportionality of providing a privacy notice directly to all data subjects ([26] above).

Undoubtedly the FTT could have structured their conclusions in a clearer way and addressed the transparency requirements of Article 5(1)(a) more explicitly. However, we are not marking an examination paper; the question for us is whether the FTT erred in law in failing to apply the transparency principle in Article 5(1)(a) to the appeal before them. For the reasons that we have identified, we do not consider that this was the case.