[2024] UKUT 105 (AAC)

Ground 1 of the Information Commissioner’s grounds of appeal is summarised at [50] above. Mr Pitt-Payne submitted that an overarching and pervasive error in the FTT’s approach was their failure to address what Article 5(1)(a) GDPR transparency requires and an allied failure to then apply this to the case before them. He said that the FTT needed to weigh up all the relevant considerations and then identify what transparency required in this context. He emphasised that providing transparency was foundational, as without it a data subject could not make an informed assessment of their rights. Mr Pitt-Payne contended that the FTT’s lack of engagement with Article 5(1)(a) was exemplified by the absence of any explicit reference to this provision (as opposed to Article 14) when the FTT came to set out their conclusions. Mr Pitt-Payne accepted that what transparency required in a particular situation would be informed by the consequences of the processing for the data subjects and confirmed that he did not challenge the FTT’s findings in terms of the absence of harmful consequences, nonetheless he submitted that the FTT had failed to have regard to a further highly relevant aspect, namely the intrinsic nature of Experian’s processing and the extent to which this went beyond data subjects’ reasonable expectations. He submitted that data subjects would not expect to be profiled in the extensive way undertaken by Experian and that in focusing on their finding that the consequences for data subjects were innocuous, the FTT had only had regard to “half the story”.

In terms of the first specific error relied upon, Mr Pitt-Payne submitted that the FTT had ignored the absolute right of a data subject to object to the processing of their personal data for direct marketing purposes conferred by Article 21(2). The existence of this absolute right was an important element in assessing what transparency required in this instance, yet the FTT’s reasoning made no reference to this provision nor to how the information provided to data subjects had addressed this aspect.

As regards the second specific error, Mr Pitt-Payne submitted that a situation where the data subject was required to navigate multiple hyperlinks, provided by different entities, in order to reach Experian’s own transparency information on the CIP was the obverse of transparency and inconsistent with its requirements. He said that the FTT had failed to focus upon the key question; was the user journey good enough in transparency terms.

The third specific error rested on the proposition that the FTT had concluded that the low number of visitors to the CIP reflected the fact that individuals did not care about how their personal data was processed and that, in turn, this was relevant to the question of what the transparency principle required. Mr Pitt-Payne submitted that in this respect the FTT had taken into account a legally irrelevant consideration; transparency requires that data subjects have an informed opportunity to exercise the rights conferred on them by the GDPR, regardless of whether they choose to do so, and any other approach would undermine the fundamental premise of the legislative scheme. Further or alternatively, he contended that the finding that data subjects did not care about how their personal data were processed was unsupported by the evidence and perverse and/or unreasoned.

In terms of the fourth specific error, Mr Pitt-Payne focused on the FTT’s reasoning as to whether data subjects would be surprised by Experian’s processing of their personal data. He said that the reasoning at [142], [165] and [177] of their decision was irrationally inconsistent and that insofar as the FTT found that the data processing was not objectively surprising to data subjects, the finding was wrong in law and/or perverse and/or unreasoned.