![[2024] UKUT 105 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png){kind=logo}
THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
UPPER TRIBUNAL JUDGE WIKELEY
UPPER TRIBUAL JUDGE CITRON
Decision date: 22 April 2024
ON APPEAL FROM:
Tribunal: First-tier Tribunal (General Regulatory Chamber)
Tribunal Case No: EA/2020/0317
NCN: [2023] UKFTT 00132 (GRC)
FTT Hearing Dates: 17, 19-21 & 31 January 2022 & 11 February 2022
FTT Decision Date: 20 February 2023
This front sheet is for the convenience of the parties and does not form part of the decision
IN THE UPPER TRIBUNAL Appeal No.UA-2023-000512-GIA
ADMINISTRATIVE APPEALS CHAMBER [2024] UKUT 105 (AAC)
On appeal from the First-tier Tribunal (General Regulatory Chamber)
Between:
The Information Commissioner
Appellant
- v -
Experian Limited
Respondent
Before: The Hon. Mrs Justice Heather Williams DBE
Upper Tribunal Judge Wikeley
Upper Tribunal Judge Citron
- Heading
- THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
- Hearing dates: 6-8 February 2024
- The structure of the Upper Tribunal’s decision
- Abbreviations
- Glossary
- The nature of Experian’s data processing
- The Information Commissioner’s Enforcement Notice
- Experian’s appeal to the First-tier Tribunal
- The Information Commissioner’s case before the First-tier Tribunal
- The hearing before the First-tier Tribunal
- The First-tier Tribunal’s decision
- The First-tier Tribunal’s findings
- The First-tier Tribunal’s conclusions
- The Substituted Enforcement Notice
- The Information Commissioner’s grounds of appeal to the Upper Tribunal
- The legal framework
- The Upper Tribunal’s “error of law” jurisdiction
- Adequacy of reasons
- Enforcement notices and appeals against them
- Recitals to the GDPR
- Proportionality
- The European Data Protection Board: decisions and guidelines
- Summary of relevant aspects of the transparency principle in the GDPR
- The parties’ overarching submissions
- Ground 1
- Experian’s submissions
- Alleged overarching errors: discussion and conclusions
- Alleged failure to address Article 5(1)(a) GDPR
- Alleged failure to identify the applicable standard of transparency
- The nature of the processing
- Relevance of the reasonable expectations of data subjects
- Alleged specific errors: discussion and conclusions
- Use of hyperlinks to the CIP
- Suggestion that people do not care about what happens to their data
- How the FTT addressed the reasonable expectations of data subjects
- Concluding observations on Ground 1
- Ground 2
- Experian’s submissions
- Alleged overarching error: discussion and conclusion
- Alleged specific errors: discussion and conclusions
- Article 14(5)(a) and whether the data subject already “has” the information
- The route from the third party suppliers to the CIP
- Article 14(5)(b)
- Concluding observations on Ground 2
- Ground 3
- Experian’s submissions
- Discussion and conclusions
- Ground 5
- Experian’s submissions
- Discussion and conclusions
- Conclusions