[2024] UKUT 105 (AAC)

The context for this appeal is helpfully summarised by the First-tier Tribunal (‘the FTT’) in paragraph 1 of its decision:

“Experian is a well-known Credit Reference Agency (“CRA”). In that capacity it holds and processes data relating to over 51 million people living in the United Kingdom, effectively the whole of the adult population. What is less well known is that Experian has within it a business unit, Experian Marketing Services (“EMS”), which processes the data of around 51 million people in the UK to provide marketing services which it sells to its third-party clients. It does so by combining their name and address information, with a total of up to thirteen actual attributes. It then processes this data and creates modelled information on the demographic, social, economic and behavioural characteristics of these 51 million individuals on a predictive basis, the profile for each person running to as many as 49 derived data points about individuals and up to 370 modelled points about individuals, with each profile running to many pages.”

The Information Commissioner, having found concerns with the extent and nature of Experian’s data processing in the light of the transparency requirements of the General Data Protection Regulation (“GDPR”), issued Experian with an enforcement notice (“EN”) after a prolonged investigation. Experian appealed to the FTT against the EN. Following hearings in January and February 2022, the FTT allowed Experian’s appeal in large part, in its decision of 20 February 2023. The Information Commissioner now appeals to the Upper Tribunal, permission to appeal having been granted by Upper Tribunal Judge Wikeley on 2 May 2023. The Chamber President subsequently directed that a three-judge panel be convened to determine the appeal as it raises a point of law of special difficulty or an important point of principle.

This appeal is primarily concerned with the principle of transparency, both the overarching duty in Article 5(1)(a) and the detailed obligations in Article 14 GDPR. It is common ground that the provision of transparency in the processing of personal data is foundational to data subjects’ rights. We understand from counsel that the transparency principle has not been the subject of any detailed judicial consideration by the Upper Tribunal or by the appellate courts so far. The Information Commissioner alleges that the FTT’s decision involved multiple errors of law and that it failed to address, or adequately address, a number of relevant issues. Experian contends that the FTT’s decision should be upheld and that the appeal essentially seeks to re-litigate unassailable findings of primary fact and evaluative assessments that were made below.

Our decision is to dismiss the appeal for the reasons that we set out.