[2024] UKUT 105 (AAC)

Next we turn to the reasonable expectations of the data subjects. We address the extent to which this was a relevant consideration for the FTT. We leave the specific criticism of the FTT’s allegedly inconsistent reasoning in [142], [165] and [177] of their decision until we come to the fourth specific error.

At one point in her oral submissions Ms Proops appeared to be suggesting that the reasonable expectation of the data subjects was not relevant to the question of what transparency required. She sought to draw an analogy with the constituent elements of the tort of misuse of private information, where it is necessary to establish a reasonable expectation of privacy for the duty to be engaged at all, but, if it is, then the second issue is whether that expectation is outweighed by a countervailing interest of the defendant. In so far as this contention was maintained, we reject it. We agree with Mr Pitt-Payne that there is no true analogy here. Showing a reasonable expectation of privacy is a threshold requirement for the existence of the right to privacy in the tort of misuse of private information. By contrast, the rights of data subjects conferred by the GDPR extend to all processing of personal data and are not dependent upon the data subject showing a reasonable expectation of privacy in relation to the processing.

We have set out [10] of the Article 29 Working Party’s guidelines on transparency at [94] above. Where the text says that a central aspect of the transparency principle is that the data subject should not be taken by surprise at a later point about the ways in which their data has been used, it is clearly referring to what a data subject may objectively expect in terms of the use of their data, not to the subjective surprise that might be experienced by a particular individual in a particular situation. Whilst the guidelines do not constitute binding law, we agree with the points made at [10], in particular that this is also an important aspect of the principle of fairness in Article 5(1)(a) GDPR and that transparency may require additional information to be provided where the processing is objectively unexpected in order to achieve the objective in Recital 39 of the GDPR that persons should be made aware of (amongst other things) the risks, safeguards and rights in relation to the processing of personal data. Accordingly, the nature and extent of the information that is to be provided to data subjects in order to comply with the requirements of transparency may be affected by whether and in what respects the processing goes beyond that which they would have reasonably expected in any event.

Turning to the FTT’s reasoning on this aspect (which we discuss in detail in relation to the fourth alleged error), we indicate at this stage that we are satisfied that the FTT did take the reasonable expectations of data subjects into account, as is reflected in the terms of their conclusion at [177].

Before leaving the alleged overarching errors we emphasise that there is no perversity challenge to the FTT’s evaluative assessment at [177] as to the clarity and accessibility of the information in the CIP.