[2024] UKUT 287 (AAC)

Mr Pitt-Payne submitted that the grant of permission included the points raised at paragraphs 19(3) and (4) of the grounds of appeal (now Issue 2). He emphasised that they were part of the Ground 1 complaint that the FTT had not determined whether the EMV Data would be personal data in the hands of third parties and that there was nothing in the grant of permission in respect of Ground 1 that clearly excluded these contentions. Furthermore, in so far as there was any ambiguity, it was to be resolved in the appellant’s favour. The Upper Tribunal’s clarification ruling could have said that these points were not within the grant of permission if that was unambiguously the case, but it did not do so.

As to the substance of Issue 2, Mr Pitt-Payne contended that the FTT made two errors, even on its own approach to the personal data issue. Firstly, having accepted in paragraph 96 of its decision that when assessing the risk of consequential damage and distress, it was relevant to know whether data that constituted personal data in the hands of a data controller, was personal data or only vanilla data in the hands of a third party who unlawfully processed it, the FTT then failed to make this assessment altogether in respect of the EMV Data. Secondly, having expressly stated in paragraph 97 that it had not gone on to consider whether the limb (iii) definition of personal data applied to the EMV Data, when it came to assessing whether the section 55A criteria was met and the quantum of the MPN, either the FTT proceeded on the basis that some degree of indirect linkage by third parties was possible or it wrongly and irrelevantly confined its assessment at these stages too to the fact that, as DSG could link the data, it was personal data in its hands.