The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

Information Commissioner loses enforcement notice appeal on Experian’s transparency

25 April 2024

The Information Commissioner’s appeal against the FTT’s decision to set aside (most of) its enforcement notice against Experian was dismissed by a very strong Upper Tribunal (Heather Williams J, and UTJs Wikeley and Citron) this week. The case relates to the issue by the IC of an enforcement notice in respect of the marketing element of Experian’s business, rather than its more familiar credit scoring. The appeal focused on whether this element of Experian’s business was sufficiently transparent, with respect to Article 5(1)(a) and Article 14 GDPR.

It’s probably best to read the judgment for a detailed explanation of what Experian was up to, and the course of the litigation to date: the broader value of the judgment lies in its consideration, for the first time at this level, of what the transparency requirement involves. It also says something about the current data protection landscape more generally.

On transparency, though, the IC argued that Experian was engaged in ‘invisible processing of personal data on a mass scale’, and that the lack of transparency involved rendered GDPR rights less effective, if not wholly ineffective. The Upper Tribunal disagreed. In doing so, it gave some helpful guidance on the role that recitals and EPDB guidelines can play in interpreting the GDPR, and then summarised the transparency principle in the GDPR at §95. This will be a touchstone for the foreseeable future when issues over transparency are raised. Key points are that the general transparency obligation may, in some circumstances, require more information to be provided than is required by Articles 13 and 14, and that what is required is context specific and underpinned by considerations of proportionality. The UT set out a non-exhaustive list of factors relevant to an evaluative judgement of what is required.

Ultimately, the UT held that while the FTT decision was ‘neither well-structured nor well-reasoned’, it nonetheless did not err in law, and conducted an appropriate context-specific evaluative exercise when it found that Experian’s processing for marketing purposes was sufficiently transparent. That is perhaps a little surprising in circumstances where the UT accepted it ‘had to undertake a significant amount of inferential work’ to understand the decision. At the time of writing, it is unclear whether the IC will seek to take the matter further.

All in all then, a helpful if dense authority on transparency. But it does also say something about the wider data protection landscape. Most data subjects would, in all likelihood, be surprised to find out that their personal data, processed by Experian for the purpose of credit scoring, was also being used for marketing purposes. That has now been held to be sufficiently transparent, after two highly technical appeals that have taken from October 2020 to April 2024. Though not taking issue with either the outcome on these facts or the UT’s (or FTT’s) technical reading of the legislation, applying a more purposive approach it might be thought that this is a pretty long way from the spirit of transparency and data subject rights that underpinned the introduction of GDPR.

Further reading:

IC v Experian [2024] UKUT 105 (AAC)

The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.

Visit the Information Law, Data Protection and AI area

Search The Data Brief

Portfolio Builder

Select the practice areas that you would like to download or add to the portfolio

Download    Add to portfolio   
Portfolio
Title Type CV Email

Remove All

Download


Click here to share this shortlist.
(It will expire after 30 days.)