[2024] UKUT 287 (AAC)

Mr Lockley referred us to paragraph 21 of Cranston J’s judgment in Department of Health, where he referred to Opinion 4/2007 issued by the Article 29 Working Party, in particular that “the definition of personal data should be as general as possible so as to include all information concerning an identifiable individual”. He submitted that whilst a PAN did not identify an individual by name, it did identify the holder of a particular bank account (assuming that there was a sole, living individual account holder). The function of the PAN was to single out the particular bank account in order to enable the relevant economic activity to occur and, in turn, this economic activity was fundamental to a particular person’s identity. It was information that was much more fundamental to a person’s identity than a coat or a car. He clarified that he was not suggesting that the EMV Data would enable an attacker to gain access to the financial information relating to the particular account, but he described the PAN as a proxy for the account.