Alleged specific errors: discussion and conclusions
Alleged specific errors: discussion and conclusions
Article 21(2)
Turning to the first alleged error, we have already accepted that the existence of an Article 21(2) absolute right to object is part of the relevant context in terms of determining what transparency requires in a particular situation ([95] above). As the parties accept that Article 21(2) applied to Experian’s data processing, it was part of the relevant context for the FTT to consider in this case.
In support of his submission that Article 21(2) was not taken into account, Mr Pitt-Payne relied on the fact that this provision was not included in the FTT’s account of the legal framework and it was not mentioned when the FTT set out their conclusions.
However, it is trite law that an appeal tribunal should not infer that the tribunal below failed to have regard to a material provision, submission or piece of evidence simply because they did not refer to it explicitly in their decision. As we have explained, the authorities establish that it is necessary to look at the substance of the decision, read as a whole and to draw appropriate inferences.
The FTT’s references to Article 21 at [40] of their decision when detailing the EN and at [52] when summarising the Information Commissioner’s response to Experian’s grounds of appeal, indicate that they were aware of this right. In addition, the FTT addressed the general right to opt out at [167], concluding that the layout and contents of the CIP did not improperly push data subjects away from exercising that right. In his reply, Mr Pitt-Payne did not take issue with Ms Proops’ description of there being a right to opt out button on the first page of the CIP and on successive pages. As their summary of his evidence makes clear, Mr Bendon provided the FTT with a detailed account of the CIP and a demonstration which took them through its structure from the front page and the introductory video onwards. They also had print outs of each of the webpages. The FTT observed that the CIP was not structured as a single web page or document (with the exception of the Article 14 pop-up privacy notice) but as “a series of connecting web pages or layouts to make it more accessible to readers” ([78]) and that Mr Bendon’s evidence (which the FTT plainly accepted) was that “there are prominent links throughout the CIP through which individuals can choose to opt out of having their data processed by Experian which takes them into a webpage entitled ‘your opt-out options’. There are also links to a ‘help’ page and an FAQs page on each page” ([79]). The FTT then referred to an online survey conducted by Experian in June 2021, in which 90% of respondents indicated that they found it easy to understand the CIP front page, 94% of respondents were able to locate the opt out button from the introductory page and 93% found it easy to understand the opt out information. The FTT commented at [81] that “this is a useful exercise although not definitive”.
In these circumstances, we agree with Ms Proops’ submission that, reading the decision as a whole, the FTT’s conclusion expressed at [177] that the CIP was sufficiently transparent in terms of the clarity and accessibility of the information it displayed, must be taken to have included a consideration of the rights to opt out and the means of doing so via the CIP.
- Heading
- THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
- Hearing dates: 6-8 February 2024
- The structure of the Upper Tribunal’s decision
- Abbreviations
- Glossary
- The nature of Experian’s data processing
- The Information Commissioner’s Enforcement Notice
- Experian’s appeal to the First-tier Tribunal
- The Information Commissioner’s case before the First-tier Tribunal
- The hearing before the First-tier Tribunal
- The First-tier Tribunal’s decision
- The First-tier Tribunal’s findings
- The First-tier Tribunal’s conclusions
- The Substituted Enforcement Notice
- The Information Commissioner’s grounds of appeal to the Upper Tribunal
- The legal framework
- The Upper Tribunal’s “error of law” jurisdiction
- Adequacy of reasons
- Enforcement notices and appeals against them
- Recitals to the GDPR
- Proportionality
- The European Data Protection Board: decisions and guidelines
- Summary of relevant aspects of the transparency principle in the GDPR
- The parties’ overarching submissions
- Ground 1
- Experian’s submissions
- Alleged overarching errors: discussion and conclusions
- Alleged failure to address Article 5(1)(a) GDPR
- Alleged failure to identify the applicable standard of transparency
- The nature of the processing
- Relevance of the reasonable expectations of data subjects
- Alleged specific errors: discussion and conclusions
- Use of hyperlinks to the CIP
- Suggestion that people do not care about what happens to their data
- How the FTT addressed the reasonable expectations of data subjects
- Concluding observations on Ground 1
- Ground 2
- Experian’s submissions
- Alleged overarching error: discussion and conclusion
- Alleged specific errors: discussion and conclusions
- Article 14(5)(a) and whether the data subject already “has” the information
- The route from the third party suppliers to the CIP
- Article 14(5)(b)
- Concluding observations on Ground 2
- Ground 3
- Experian’s submissions
- Discussion and conclusions
- Ground 5
- Experian’s submissions
- Discussion and conclusions
- Conclusions
![[2024] UKUT 105 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png)