[2024] UKUT 105 (AAC)

The first question that we need to determine in relation to the third alleged error is the correct approach to “already has” in Article 14(5)(a). Whether or not the data subject “has” the prescribed information is not a concept that is further defined in the GDPR and, as far as we are aware, there is no earlier authority that has considered this. We emphasise that, as we have explained at [96] above, we approach this issue on the basis of the parties’ agreed position that Article 14(1) is not satisfied where data subjects receive the information specified in Article 14(1) and (2) otherwise than by direct provision from the data controller, in this instance, in part via websites other than Experian’s (which, in due course, via hyperlinks, could lead them to the CIP). We emphasise this because it might otherwise be thought to be a rather strained use of the concept of the data subject “already” having the prescribed information, for it to cover a situation where the prescribed information is partially imparted by the controller itself via Experian’s CIP at the end of the user’s route. However, Mr Pitt-Payne did not take issue with the applicability of Article 14(5)(a) on this basis; as we have already summarised, his position was that this exception did not apply because the ability to receive the information via a trail of hyperlinks did not amount to the data subjects “having” the information.

Mr Pitt-Payne accepted that “having” the information was not confined to a situation where a data subject actually read the relevant material. He agreed that if a data subject received a privacy notice in the post which they chose not to read, they plainly “had” that information. Importantly for present purposes, he also agreed that those data subjects who did click on the hyperlinks on the external websites and thereby arrived at the CIP “had” the prescribed information, whether or not they chose to read the pop-up notice or other information contained on the website. We agree with these concessions. It would be quite unrealistic to suggest that a data subject only “had” the prescribed information if they elected to consider it, or only “had” it if they were in physical possession of a hard copy. The latter is consistent with Recital 58 to the GDPR ([85] above) which expressly recognises that information addressed to the data subject may be provided in electronic form in appropriate situations. This is also recognised in the Article 29 Working Party guidelines, for example at [11], [35] and [36] ([94] above), which specifically address the provision of information to data subjects in a digital environment (and which we consider further in relation to Ground 3, below).

However, once it is rightly accepted that the Article 14(5)(a) requirement may be met by the provision of the prescribed information in an electronic form including on a website accessed via a hyperlink, it seems to us that it is a question of fact and degree, rather than a matter of rigid principle, as to whether the ability to access the relevant information via a hyperlink or series of hyperlinks satisfies the Article 14(5)(a) exception. Both counsel suggested to us that “has” was an ordinary word that it was not helpful to try and define further. We agree. We conclude that whether the data subject already “has” the prescribed information is a question of fact, which is to be answered by reference to the specific circumstances, particularly the accessibility and the clarity of the information, and bearing in mind the underpinning principle of transparency which we have already discussed at [95] above. We consider it less likely that the nature of the processing or its likely impact will bear directly on this question, but we do not rule that out. We consider that the approach we have outlined is in keeping with the GDPR Recitals and the passages in the Article 29 Working Party guidelines on transparency which we have already set out.

In his reply, Mr Pitt-Payne suggested that if the Article 14(5)(a) exception was broad enough to accommodate the present case, it would be sufficient for an external website to simply state that data subjects’ personal data was shared with Experian and to provide no website address for the CIP, hyperlink to it or other information on how to access it. We do not agree that this follows from the approach to Article 14(5)(a) that we have identified. We emphasise that we are not deciding that the Article 14(5)(a) exception will be established in every instance in which data subjects are given some means of arriving at the prescribed information, even if research or inquiry on their part is involved. To the contrary, we have indicated that it will always be a question of fact and degree as to whether or not the data subject already “has” the prescribed information.

We turn to the conclusions reached by the FTT. We regard the following findings as significant. At [161] the FTT found that the CRAIN provided individuals with an understanding of Experian’s business and links to further material. At [162] they noted that the route to the CIP would be facilitated by hyperlinks and the reasonable data subject would be familiar with hyperlinks and how to follow them. At [169] the FTT found that there was “a sufficiently easy to follow trail through hyperlinks to the CIP from the privacy notices which enables people who are concerned about their privacy to follow that route to learn more”. Then in their conclusions section at [177] the FTT found that the processing was sufficiently transparent in respect of CRA derived data in the context of privacy notices served on data subjects who provided their data to lenders. The FTT’s assessment was that, “The hyperlinks and websites are simple to follow, and we find, having considered the CIP in detail, that in its current form ... it is adequately clear”; and that the relevant information on the CIP was “accessible to data subjects who want to understand how their data will be processed”.

We have already explained when addressing the alleged overarching error, that whilst the FTT did not use the language of Article 14(5)(a) in setting out their conclusion, we are satisfied that the FTT’s assessment at [177], read in the context that we have identified, was a conclusion that the Article 14(5)(a) exception applied. Given the “fact and degree” approach to Article 14(5)(a) that we have endorsed, we do not consider that the FTT erred in principle in reaching this conclusion. This was a conclusion that was open to them and it appears that relevant matters, particularly accessibility and clarity, were taken into account. There is no perversity challenge mounted to any of the findings that we have referred to in our preceding paragraph and no apparent gap in the FTT’s logic. Accordingly, there is no recognised basis upon which Mr Pitt-Payne can disturb the FTT’s assessment. A significant portion of his oral submissions expressed disagreement with this assessment and appeared to be directed towards persuading us that we should arrive at a different conclusion, but this is not a situation in which it would be appropriate for us to re-take the evaluative assessment arrived at by the FTT. Indeed, it would be particularly inappropriate for us to do so in circumstances where the evidence heard by the FTT included a detailed presentation relating to the hyperlinks from the external websites and the contents of the CIP.