[2024] UKUT 287 (AAC)

We accept that we are in a position to determine whether the EMV Data itself (as opposed to when combined with other data) constitutes personal data. We agree that this is a question of pure law and that it will assist the FTT on remission for us to decide it.

We clarified with the parties that there was no inter-relationship between the digits of a PAN and the digits comprising a particular bank account number; they were simply two separate unique identifiers of an account. The PAN gave no indication of the bank account number or sort code. Counsel drew an analogy with a motor vehicle that may be identified by its VIN or by its numberplate, but these identifiers are entirely separate from each other.

We concluded that the EMV Data does not amount to personal data in itself. It does not identify any individual directly. It does not enable financial information relating to the usage of the particular bank account to be accessed. The PAN simply provides a link to a unique bank account. Whether the EMV Data can be combined with other data to identify a living individual is neither here nor there from a limb (i) perspective; that is (depending on context) a limb (ii) or (iii) question.

We do not consider that the sheer fact that the PAN is a unique number identifying a particular account alters this position. Mr Pitt-Payne’s analogy with the VIN in Scania is an apt one. The Court of Justice indicated that the unique alphanumeric code assigned to the vehicle by its manufacturer did not in itself constitute personal data; it was only personal data in so far as the person who had access to it had the means of enabling them to use it to identify the owner of the vehicle to which it related.

We were not persuaded by Mr Lockley’s emphasis upon the purpose of the PAN being to enable economic activity in relation to the particular bank account. Whilst such activity would undoubtedly be of importance to the holder of the account, the fact remains that the EMV Data does not identify them.

Accordingly, the limb (i) definition of personal data does not apply to EMV Data for the purposes of the FTT considering on remission whether, pursuant to DPP7, DSG took ATOMS against unauthorised or unlawful processing of personal data.