[2024] UKUT 105 (AAC)

As we have indicated, the FTT allowed the appeal in part. The decision itself commenced with a substituted Decision Notice in the form of the SEN. The FTT’s reasons then ran to some 45 pages and 187 paragraphs. The FTT started with an introduction and a review of background matters, focussing on the Information Commissioner’s EN ([1]-[30]). This was followed by a detailed account of Experian’s grounds of appeal ([31]-[46]) and the Information Commissioner’s response ([47]-[55]). The FTT then dealt with the hearing and in particular reviewed the oral evidence tendered on behalf of the parties at some length ([57]-[110]). In the next section, entitled “The Tribunal’s Function”, the FTT included relevant provisions of the DPA 2018, followed by Articles 4-7, 12 and 13-14 of the GDPR ([111]-[129]). The FTT set out their “Findings” at [130]-[171] and then their conclusions in a section headed “Has there been a breach as the Information Commissioner submits?” at [172]-[187].