[2024] UKUT 105 (AAC)

We can also deal with the third alleged error relatively shortly. The key passage in the FTT’s decision appears at [166]. We are satisfied that the FTT’s reference to research data showing that most people do not care about what happens to their data was made in order to address a submission made by the Information Commissioner that the fact that only 130,000 unique IP addresses had visited the CIP, out of the 7 million visitors to Experian’s main website, indicated that the existence of the CIP was not made sufficiently clear to data subjects. Mr Pitt-Payne’s written closing submissions confirm that this was the way that this aspect of the case was put before the FTT. Accordingly, at [166] the FTT were simply saying that the relatively few visitors to the CIP was consistent with the picture revealed by independent research data and was not indicative of a lack of transparency in terms of the existence of and the route to be taken to arrive at the CIP. We are equally clear that the FTT did not rely upon their understanding that most people do not care about what happens to their data in any broader sense and in particular they did not rely on this to dilute or undermine the requirements of transparency. Indeed, at [169] the FTT said in terms that whilst people may choose not to read privacy policies, “The processing must still be fair, lawful and transparent”.

Mr Pitt-Payne’s secondary argument was that there was no evidential basis before the FTT from which they could have concluded that people do not care about what happens to their data. We agree with Ms Proops that, read in context, the “research data” that the FTT had in mind was plainly the CMA’s report ([113] above). In his reply Mr Pitt-Payne submitted that even if this was the “research data” that the FTT had in mind, it did not bear out the statement that people do not care what happens to their data. Counsel took us to various passages in this lengthy report. In summary, what these showed was that research indicated that most people did not access / read privacy policies, as opposed to it indicating that they did not care what happens to their data. Accordingly, the last sentence of the FTT’s [166] was clumsily phrased. However, the point that they were in fact seeking to make, namely that data subjects’ lack of engagement with the CIP does not indicate that it was inaccessible, is borne out by the contents of the CMA’s report.