The nature of the processing
The nature of the processing
We turn to the approach that the FTT did adopt. They plainly addressed the impact of the processing in some detail at [152]-[160] of their decision, finding that the worst outcome of Experian’s processing was that an individual is likely to get a marketing leaflet that is more aligned to their interests, rather than irrelevant material. Mr Pitt-Payne does not challenge this finding. As we explain in the next paragraph, we consider that the FTT also had regard to the nature of the data and to Experian’s processing.
The FTT were clearly alive to the significance of the nature of the data, as shown by [121] of their decision. Furthermore, the FTT went on to find in terms at [145] that the modelled data points used by Experian were less intrusive than the processing of actual data. In light of this finding, the number of modelled data points used by Experian was not of particular significance. In any event, the FTT were clearly aware of the scale of this and that 370 modelled points were used, as they said this in terms at [144]. In addition the FTT found at [153], and were entitled to take into account, that the Information Commissioner had not properly appreciated the limited extent to which the CRA derived data was used. The FTT also made findings at [157] as to the limited number of attributes derived from the data that were provided to Experian’s clients and, in the same paragraph, as to the controls operated by Experian. None of these findings are challenged or could be challenged before us. Accordingly, we reject the contention that the FTT failed to have regard to the intrinsic nature of Experian’s processing.
- Heading
- THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
- Hearing dates: 6-8 February 2024
- The structure of the Upper Tribunal’s decision
- Abbreviations
- Glossary
- The nature of Experian’s data processing
- The Information Commissioner’s Enforcement Notice
- Experian’s appeal to the First-tier Tribunal
- The Information Commissioner’s case before the First-tier Tribunal
- The hearing before the First-tier Tribunal
- The First-tier Tribunal’s decision
- The First-tier Tribunal’s findings
- The First-tier Tribunal’s conclusions
- The Substituted Enforcement Notice
- The Information Commissioner’s grounds of appeal to the Upper Tribunal
- The legal framework
- The Upper Tribunal’s “error of law” jurisdiction
- Adequacy of reasons
- Enforcement notices and appeals against them
- Recitals to the GDPR
- Proportionality
- The European Data Protection Board: decisions and guidelines
- Summary of relevant aspects of the transparency principle in the GDPR
- The parties’ overarching submissions
- Ground 1
- Experian’s submissions
- Alleged overarching errors: discussion and conclusions
- Alleged failure to address Article 5(1)(a) GDPR
- Alleged failure to identify the applicable standard of transparency
- The nature of the processing
- Relevance of the reasonable expectations of data subjects
- Alleged specific errors: discussion and conclusions
- Use of hyperlinks to the CIP
- Suggestion that people do not care about what happens to their data
- How the FTT addressed the reasonable expectations of data subjects
- Concluding observations on Ground 1
- Ground 2
- Experian’s submissions
- Alleged overarching error: discussion and conclusion
- Alleged specific errors: discussion and conclusions
- Article 14(5)(a) and whether the data subject already “has” the information
- The route from the third party suppliers to the CIP
- Article 14(5)(b)
- Concluding observations on Ground 2
- Ground 3
- Experian’s submissions
- Discussion and conclusions
- Ground 5
- Experian’s submissions
- Discussion and conclusions
- Conclusions
![[2024] UKUT 105 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png)