[2024] UKUT 105 (AAC)

We have summarised the Information Commissioner’s Ground 2 at [51] above. Mr Pitt-Payne contended that the overarching error was the FTT’s failure to approach Article 14 GDPR in a structured way, distinguishing between the three questions that arose in this case. He said that the FTT should firstly have determined whether Experian had itself provided data subjects with the information required by Article 14(1); and then, upon finding that it had not, the FTT should have addressed in terms whether the ground for disapplying the Article 14(1) duty provided for by Article 14(5)(a) had been established (that data subjects already had the information) and, if this was not the case, whether the Article 14(5)(b) ground for disapplication (disproportionality) applied.

Turning to the specific errors, Mr Pitt-Payne submitted that the only conclusion open to the FTT in relation to Article 14(1) was that Experian had not provided the prescribed information and that it was incumbent on the FTT to state this. The second and linked error, said Mr Pitt-Payne, was that the FTT’s failure to recognise that Article 14(1) had not been complied with infected their consideration of the Article 14(5) issues. The FTT’s starting point should have been that Experian were having to rely upon exceptions to the Article 14(1) duty, which, as such, should be narrowly construed.

Thirdly, Mr Pitt-Payne submitted that the FTT had erred in law in their application of Article 14(5)(a), if, indeed, this was the conclusion that they had reached at [177]. He noted that this conclusion was not expressed in terms of the Article 14(5)(a) criterion, namely whether the data subject “already has the information” and he suggested that this indicated that the FTT had failed to ask themselves the correct question. Furthermore, he contended that the user routes to the CIP, whether via the hyperlinks in the CRAIN on the lenders’ websites or via the links on the websites of the third party suppliers, could not, as a matter of law, amount to the data subjects “having” the prescribed information (which was admittedly contained within the pop-up privacy notice on arrival at the CIP). He said that in these circumstances, whilst a data subject was told what they could do to acquire the prescribed information, unless they in fact followed the links through to the CIP they did not “have” that information for the purposes of Article 14(5)(a).

In terms of the fourth specific error that he relied upon, Mr Pitt-Payne emphasised the absence of any explicit conclusions in respect of data subjects whose data was provided to Experian via third party suppliers; the FTT’s conclusion at [177] was expressed to relate to the CRA data subjects and there was no equivalent reference to those who provided their data via the third party suppliers’ websites. He said that the only potentially material reference to the latter came in [133] of the FTT’s decision and in terms that suggested a finding that such data subjects would not “have” the Article 14 information. There was no equivalent to the FTT’s finding at [161] in respect of the CRAIN providing individuals with an understanding of Experian’s business and links to further material and the third party suppliers route required separate consideration. Mr Pitt-Payne also drew attention to the absence of any explicit reference in the FTT’s conclusions to Requirement C7 of the EN, which was aimed at Experian improving the information provided to data subjects by third party suppliers.

As regards the fifth specific error, Mr Pitt-Payne emphasised that the FTT had not addressed the Article 14(5)(b) disproportionality exception in respect of the main cohort of data subjects. He said that as it was clear from the FTT’s finding that Experian could not rely upon this exception in relation to the residual cohort, it could not have applied to the main cohort either.

Mr Pitt-Payne also submitted that the FTT had failed to provide adequate reasons in respect of the findings that they purported to make in relation to Article 14.