The Upper Tribunal has dismissed the ICO’s appeal in ICO v Experian [2024] UKUT 105 (AAC).
Experian is a well-known credit reference agency. It holds and processes data relating to over 51 million people living in the UK (effectively the entire adult population). It also processes the data of UK residents to provide marketing services which it sells to its third-party clients.
The ICO was concerned about the extent and nature of Experian’s data processing in the light of the transparency requirements of the GDPR and issued Experian with an enforcement notice. Experian appealed to the First Tier Tribunal, which allowed large parts of its appeal and the enforcement notice was scaled back. The ICO in turn appealed to the Upper Tribunal, which has now issued its ruling.
The appeal was primarily concerned with the principle of transparency, both the overarching duty in Article 5(1)(a) and the more detailed obligations in Article 14 GDPR. It was common ground between the parties that the provision of transparency in the processing of personal data is foundational to data subjects’ rights. The transparency principle has not been the subject of any detailed judicial consideration by the Upper Tribunal or by the appellate courts to date.
The ICO alleged that the FTT’s decision involved multiple errors of law and that it failed to address, or adequately address, several relevant issues. Experian contended that the FTT’s decision should be upheld and that the appeal essentially sought to re-litigate unassailable findings of primary fact and evaluative assessments.
The Upper Tribunal dismissed the ICO’s appeal.
It rejected each of the alleged errors of law that the ICO argued had been made. It said that the FTT’s decision was neither well-structured nor particularly well-reasoned, but the Upper Tribunal was satisfied that, applying the approach that the appellate authorities required it to take, there was no error of law in the FTT’s approach.
The Upper Tribunal also decided that, whether the ability to access the information prescribed by Article 14 via a series of hyperlinks was sufficient to satisfy the exception in Article 14(5)(a) that applies where a data subject already “has” that information, was a question of fact and degree. In doing so, the panel addressed the secondary basis on which the ICO put its case, that is, that the FTT’s decision was inadequately reasoned. Having undertaken a significant amount of inferential work, the panel was satisfied that the FTT’s reasons were not so inadequate as to amount to an error of law.
The Upper Tribunal rejected the ICO’s submission that the FTT did not have regard to or determine the ICO’s concerns regarding the layering of the information provided on Experian’s Consumer Information PortaI. It was for the FTT to make its own evaluative assessment as to whether information about Experian’s processing was sufficiently prominently displayed on the Portal; it did make that assessment and decided that it was sufficiently prominently displayed.
The Upper Tribunal also said that it was apparent from the terms of the enforcement notice that the ICO thought that the legitimate interest assessments should be reconsidered because it believed that Experian’s processing was intrusive, non-transparent and harmful. However, the FTT had rejected each of these propositions and there was no challenge to their conclusion in terms of the relatively innocuous nature of the processing involved. Moreover, the Upper Tribunal dismissed the grounds of appeal that challenged the FTT’s findings on intrusiveness and on transparency. It followed that the FTT’s decision contained a reasoned rejection of the ICO’s case, although it could have been clearer.
The ICO has published a statement on the decision, saying it will “take stock of [the] judgment and carefully consider our next steps, including whether to appeal”.
