Upper Tribunal Administrative Appeals Chamber

[2024] UKUT 105 (AAC)

Fecha: 22-Abr-2024

Summary of relevant aspects of the transparency principle in the GDPR

Summary of relevant aspects of the transparency principle in the GDPR

95.

In light of the materials we have referred to and drawing the threads together for the purposes of this case, we summarise the “transparency” principle in the GDPR as follows:

there is an overarching obligation to process personal data in a transparent manner in relation to the data subject;

it is achieved, principally, by providing information to data subjects about how their personal data is being processed;

it is a lynchpin of, or gateway to, the GDPR, because, without this information, data subjects cannot enforce the rights afforded them under the GDPR to have their personal data protected;

it should result in data subjects being aware of risks, rules, safeguards and rights in relation to the processing of personal data and the specific purposes for which the data is being processed; it is part of the obligation on the controller to facilitate the exercise of data subject rights under the GDPR;

the core principle of transparency is contained in Article 5(1)(a) GDPR, whereas Articles 13 and 14 impose specific obligations that are linked to this core principle;

GDPR is prescriptive about the kinds of information that data subjects are to be provided with, as a basic minimum (this is Articles 13 and 14);

the accessibility and comprehensibility of the information is as important as its content. Article 12 GDPR prescribes that the Article 13/14 information (and the other information referred to in Article 12) must be provided to data subjects:

in a concise, transparent, intelligible and easily accessible form, and

ii.

in clear, plain language;

depending upon the particular circumstances, the general transparency obligation imposed by Article 5(1)(a) may require the provision of information that in terms of its content goes beyond the requirements of Articles 13 and 14;

the GDPR does not prescribe precisely to what lengths a controller must go to ensure that the outcomes summarised in d. above are achieved; and in particular

within the Article 13/14 framework, the GDPR does not prescribe exactly what, for example, qualifies as an “easily accessible” form of information provision; and

ii.

the GDPR does not prescribe when the controller is expected to go “above and beyond” the Article 13/14 framework;

in these areas, where the GDPR is not prescriptive, the answer to what transparency requires will be context specific and underpinned by considerations of proportionality. It will be a matter for evaluative judgement, based on all the relevant facts and circumstances, including:

what kind of personal data are being processed? Some personal data are more “sensitive”, such that data subjects are more in need of “protection” during their processing, than others. This, we believe, is the point made in the FTT’s decision at [121] that “what is or is not transparent will be fact-specific and context related. The level of transparency required, for example, when sharing intimate health details will not be the same as people consenting to the processing of, for example, data about their preferred supermarket”. We agree with this;

ii.

what kind of processing is the personal data being subject to and for what purpose? Similar to the above, some forms of processing are more intrusive and/or more “sensitive”, such that data subjects are more in need of “protection” of their personal data, than others. As we discuss under Ground 1, the extent to which the processing is outside the reasonable expectations of data subjects will be a part of this consideration;

iii.

the consequences of the processing, including the nature and degree of harm (or benefit) to data subjects that may result;

iv.

the degree of connection between the personal data being processed and a particular GDPR right, including an “absolute” right to object to the processing, such as that under Article 21(2)-(3);

the costs for the controller of taking additional steps to ensure the desired outcomes summarised at d. above;

the requisite information may be provided in a number of ways, including in an electronic form. However, what is appropriate in any particular situation will depend upon all the relevant circumstances.

96.

The parties were agreed that Article 14(1) and (2) were not satisfied where data subjects received the information set out in Article 14(1) and (2), otherwise than via its direct provision by the controller, for example where part of the information was provided by websites other than Experian’s. Accordingly, we proceed on this basis for the purposes of the appeal, but we express no view on this reading of Article 14(1) and (2), as it was not in contention and we did not hear argument on the point. What was, of course, in contention was whether Article 14(1) and (2) did not apply in this case, because Article 14(5) was satisfied as data subjects already had the information required by Article 14(1) and (2).