[2024] UKUT 105 (AAC)

The Information Commissioner advances five grounds of appeal before the Upper Tribunal.

Ground 1 is an overarching transparency ground, alleging that the FTT failed to address what the principle of transparency, enshrined especially in Article 5(1)(a) GDPR, required as a matter of law, and furthermore failed adequately to apply a legally accurate interpretation of that principle to the issues of fact, law and assessment which arose, including failing to take into account the adverse impact on transparency from the way in which Experian processed data. The Commissioner submitted that these overarching errors were manifested in four specific errors, namely: (i) the FTT’s failure to take into account the absolute Article 21(2) GDPR right to object to direct marketing processing; (ii) the apparent assessment that Experian’s transparency obligation could be secured through the use of a series of hyperlinks, an assessment that was unlawfully inconsistent with the legal principle of transparency; (iii) the FTT’s apparent conclusion that individuals do not care about how their personal data is processed by Experian; and (iv) concluding that data subjects would not find Experian’s processing surprising, notwithstanding a finding elsewhere in the FTT’s reasoning that the processing was indeed surprising.

Ground 2 concerns the data subject’s journey to the CIP. Again, both overarching and specific errors are relied upon. As to the former, it is argued that the FTT failed to distinguish and analyse the separate legal issues arising from each of Articles 14(1), (5)(a) and (5)(b) GDPR. This is said to have led to the following specific errors: (i) the FTT failed to make a finding in respect of the Article 14(1) duty; (ii) in consequence, the FTT did not have regard to the significance of Experian’s non-compliance with Article 14(1); (iii) in relation to its apparent application of Article 14(5)(a), the FTT erred in holding that the provision of hyperlinks to privacy information was sufficient to constitute the data subject ‘having’ that information already; (iv) the FTT wholly failed to address the Article 14 position of data subjects whose personal data had been supplied to Experian by third party data suppliers; and (v) had the FTT properly rejected the application of Article 14(5)(a), it would have been bound – consistent with its findings relating to the residual cohort – to refuse to apply Article 14(5)(b) and to find a general breach of Article 14 on the part of Experian.

Ground 3 deals with the content of the CIP. It is said that the FTT erred in law by failing to address the pleaded issue of the compliance of the CIP with Article 5(1)(a) GDPR, or making any findings on the criticisms made in the EN of the CIP’s approach to layering of important privacy information and so its accessibility.

Ground 4 is that the FTT’s approach to the terms of the SEN in respect of the breach of Article 14 that it did find was flawed, because of the errors of law identified in Grounds 1 and/or 2. It was accepted that Ground 4 stood or fell with Grounds 1 and 2.

Ground 5 is that the FTT failed to address the pleaded issue as to the requirement laid on Experian to re-conduct its LIAs, notwithstanding the findings it had made against Experian’s case.

Whilst Mr Pitt-Payne criticised the adequacy of the FTT’s reasoning in developing the grounds of appeal, he submitted that his reasons challenge was secondary to the errors that he foregrounded.

Mr Pitt-Payne confirmed to us during the appeal hearing that he did not challenge any of the following findings made by the FTT: (i) the negative assessment of Mr Hulme’s evidence ([128],[136], [142], [155] and [158] of their decision in particular); (ii) that using modelled data points was less intrusive than processing actual data [145]; (iii) the benefits that resulted from the uses of the data and the conclusion that the worst outcome of Experian’s processing was that an individual was likely to get a marketing leaflet which might align to their interests rather than be irrelevant ([152] and [154]-[160]); (iv) as to the controls that were operated by Experian ([157]); and (v) that it was unlikely that any person suffered damage or distress ([187]). The appeal therefore proceeds on the basis of those findings.

Mr Pitt-Payne did not advance the time that it had taken the FTT to provide their decision as a free-standing ground of appeal, but he submitted that this was relevant to our evaluation of the FTT’s reasoning and it meant that we should approach their reasoning with particular care.

Finally, we record that there was no cross-appeal by Experian in relation to the FTT’s decision insofar as it related to the residual cohort.