[2024] UKUT 105 (AAC)

The FTT’s decision could have been much clearer in terms of their approach to Article 14 GDPR. Nonetheless, we are satisfied that the FTT did identify and analyse the issues that they needed to consider in respect of the Article.

It is clear from the contents of [175] of their decision that the FTT directed their minds to whether the requirements of Article 14 had been met. It is also apparent that the FTT had the provisions of Article 14 well in mind. Article 14 was set out in full at [116] of their decision and the terms of Article 14(5) were set out again at [175].

We agree with Ms Proops that there was no need for the FTT to set out a finding that Article 14(1) had not been complied with, as it was no part of Experian’s appeal against the EN to suggest that it had. Experian simply relied upon the Article 14(5) exceptions. This is clear from Experian’s grounds of appeal. Requirements B4-B5 of the EN were addressed at [38]-[39] of that document. Experian asserted that there had been no failure to comply with Article 14 given that: (i) “to a very large extent, Experian has already effectively ensured that the affected data subjects have the relevant transparency information, such that the Article 14(1) duty to provide a privacy notice direct to the data subject is disapplied pursuant to Article 14(5)(a) GDPR”; and/or (ii) providing a direct notification to data subjects who had not obtained the information would entail a disproportionate effort, so that Article 14(5)(b) applied. Furthermore, it is clear that the FTT appreciated that the issues they had to decide concerned the Article 14(5) exceptions. After referring in general terms to Article 14 at [175], the FTT observed that the GDPR was “clear about the limited circumstances in which the requirement to give an article 14 notice may be avoided. These are set out in paragraph 5 of article 14”. They then repeated the terms of Article 14(5). There was never any question of Article 14(5)(c) or (d) applying. Accordingly, the FTT’s conclusions that followed were, in Article 14 terms, plainly focused on Article 14(5)(a) and/or (b).

In turn, it is readily apparent that the conclusions expressed by the FTT at [177] partly concerned the accessibility of the route to the CIP for the CRA data subjects. In light of the issues before the FTT, the clear and appropriate inference to draw is that this conclusion was addressed to the applicability of Article 14(5)(a) and to whether the data subjects already “had” the information. We agree with Ms Proops that in the circumstances Article 14(5)(a) is the only realistic candidate. Furthermore, there is no reference to “disproportionate effort” or anything else that would suggest that the FTT were in fact addressing the Article 14(5)(b) exception, rather than Article 14(5)(a), in relation to the main cohort.

Our analysis is reinforced by the way that the FTT then addressed the residual cohort. If there was any question of Article 14(1) having been complied with, it would have been necessary for the FTT to have considered this before finding a contravention of Article 14 in relation to those data subjects. However, the FTT moved straight to the Article 14(5) exceptions, in this instance (and in contrast to its approach to the main cohort), addressing at [178] whether Article 14(5)(b) applied. As the residual cohort were those data subjects who had not received any notice of the data processing, plainly Article 14(5)(a) could not apply to them.