Experian Limited v The Information Commissioner
[2023] UKFTT 132 (GRC)
The Information Commissioner v Experian Limited
22 April 2024
[2024] UKUT 105 (AAC)
Upper Tribunal
The Information Commissioner sued Experian for not being transparent enough about how it uses people's data for marketing. A lower court mostly sided with Experian. The higher court agreed with the lower court, saying Experian did enough to be transparent, even if it wasn't perfectly clear. The key is that people could find the information if they looked for it, and that Experian followed the rules about letting people opt-out of marketing.
Key Facts
- •Experian, a Credit Reference Agency (CRA), processes data of 51 million UK adults for marketing services.
- •The Information Commissioner (IC) issued an Enforcement Notice (EN) against Experian for GDPR transparency breaches.
- •Experian appealed to the First-tier Tribunal (FTT), which largely allowed the appeal.
- •The IC appealed to the Upper Tribunal (UT), challenging the FTT's decision on transparency.
- •The UT dismissed the IC's appeal.
Legal Principles
Transparency in processing personal data is foundational to data subjects' rights.
GDPR Article 5(1)(a) and Article 14
Transparency requirements are context-dependent and proportionate to the facts.
GDPR, Recital 4
Article 14(5)(a) GDPR exception applies where the data subject already has the information; this is a question of fact and degree, considering accessibility and clarity.
GDPR Article 14(5)(a)
Appellate courts should be cautious in differing from trial judges' evaluative judgments unless there is a demonstrable error of law.
Lifestyle Equities CV v Amazon UK Services Ltd [2024] UKSC 8
Data subjects have an absolute right to object to direct marketing processing (Article 21(2) GDPR).
GDPR Article 21(2)
Outcomes
The UT dismissed the IC's appeal.
The UT found that the FTT had not erred in law. While the FTT's reasoning was criticized for being unclear and poorly structured, the UT concluded that the FTT had considered the relevant legal principles and facts, and that its evaluative judgments were not demonstrably wrong.
The FTT largely allowed Experian's appeal against the EN.
The FTT found that Experian's data processing, while extensive, did not result in adverse outcomes for data subjects and that the transparency provided, although not perfect, was sufficient. A breach of Article 14 was found only regarding a small subset of data subjects (the residual cohort), for whom a substituted enforcement notice was issued requiring future compliance.