[2024] UKUT 105 (AAC)

The FTT’s SEN was accordingly in the following terms:

“SUBSTITUTE DECISION NOTICE

1.

By the date that is three months after the date of this decision (the “Relevant Date”), Experian must set up a system that enables it to provide all data subjects whose personal data is obtained by Experian from one or more of the Open Electoral Register, the Registry Trust Limited or Companies House (those data subjects being the “Relevant Data Subjects, and those sources together being the "Open Sources”) with a privacy notice (a “Relevant Notice”).

2.

The Relevant Notice must: (i) inform the Relevant Data Subject that their personal data has been obtained by Experian and is being processed by it for direct marketing purposes, and (ii) otherwise comply with Article 14 of the UK GDPR. For the avoidance of doubt:

(a)

A Relevant Notice may be provided to the Relevant Data Subject by Experian either (i) through any form of direct communication by Experian with the Relevant Data Subject (e.g. through the post or, if Experian has the relevant contact details for the Relevant Data Subject, via email or text message) or (ii) through the medium of the notifications given to Relevant Data Subjects by the Open Sources.

(b)

No Relevant Notice is required to be sent where: (i) Experian has obtained personal data about the Relevant Data Subject from its CRA business, its consumer services business or from third party commercial suppliers, or (ii) Experian’s processing of the personal data of the data subject is confined to the retention or sale of the Open Electoral Register, or (iii) Experian’s processing of the personal data of the data subject relates solely to the obtaining and use of directory enquiry databases such as BT OSIS or suppression databases like the TPS, or (iv) Experian ceases to process personal data about the data subject for direct marketing purposes at any time prior to the point at which, pursuant to this Substitute Enforcement Notice, a Relevant Notice would otherwise be required to be sent to the data subject.

3.

Subject to paragraph 2 above, the Relevant Notices must be sent to the Relevant Data Subjects as follows:

(a)

Within twelve months of the Relevant Date, Experian must provide a Relevant Notice to all data subjects whom it identified as being Relevant Data Subjects as at the Relevant Date.

(b)

In circumstances where Experian obtains personal data from the Open Sources in respect of data subjects who: (i) were not identified by Experian as having been Relevant Data Subjects as at the Relevant Date, but (ii) are identified by Experian as being new Relevant Data Subjects, Experian must provide those individuals with a Relevant Notice.

4.

Nothing in this Enforcement Notice requires Experian to provide more than one Relevant Notice to a Relevant Data Subject.

5.

No financial penalty is imposed.” (Emphasis in the original text.)

In his order granting the Information Commissioner permission to appeal, Upper Tribunal Judge Wikeley suspended the effect of the SEN pending the determination of this appeal.