[2024] UKUT 105 (AAC)

The Information Commissioner resisted Experian’s appeal, reiterating her argument that Experian was engaged in invisible processing of personal data on a mass scale. She contended that the lack of transparency involved meant that data subjects’ GDPR rights were rendered less effective, if not wholly ineffective. It was not accepted that compliance with the EN would require Experian to shut down its offline marketing business.  

With regard to the requirements set out in the EN, the Information Commissioner denied she was imposing too high a standard, arguing that Experian’s case failed to recognise that the principal requirement of transparency is a high level obligation and it is the necessary role of the national supervisory authority under the GDPR scheme to form a view on compliance. It was denied that the EN required excessive detail which would diminish transparency nor was it accepted that what was required was too vague. 

We note that by the time of the FTT hearing there was no dispute that the CIP displayed an Article 14 ‘pop-up’ privacy notice containing the requisite information. However, the Information Commissioner contended that the content and layout of the CIP did not comply with the Article 5 transparency requirements, given both the nature of Experian’s data processing and the layering of the CIP’s web pages. The Information Commissioner further submitted that the data subjects’ routes to the CIP via both the CRAIN and the third party suppliers did not comply with Article 14.

The Information Commissioner also maintained that Experian’s approach to the legitimate interests assessment (“LIA”) was deficient in that it had failed to have regard to relevant considerations, in particular the expectations of data subjects, the scale and intrusive nature of its profiling and processing, and the lack of sufficient transparency.