The Information Commissioner v Experian Limited

The GDPR transparency principle is overarching and may require information beyond the specific duties in Articles 13 and 14. Its application is context-specific and proportionate. Relevant considerations include the nature of the data and processing, its consequences, the data subject’s GDPR rights, reasonable expectations and the controller’s compliance costs.

Whether a data subject “already has” information under Article 14(5)(a) is a question of fact and degree. Electronic information, including information reached through hyperlinks, may suffice where it is clear and accessible. The appeal was dismissed because the First-tier Tribunal’s evaluative conclusions disclosed no error of law.

Experian processed personal data for offline direct-marketing services, including data obtained from credit-reference, public and third-party sources. The Information Commissioner issued an enforcement notice alleging breaches of the GDPR’s transparency, lawfulness and legitimate-interests requirements.

The First-tier Tribunal allowed Experian’s appeal in large part, finding that the processing was sufficiently transparent for the main cohort but that Article 14 had been breached in respect of a residual cohort. It substituted an enforcement notice. The Information Commissioner appealed on five grounds, concerning the transparency principle, the route to Experian’s Consumer Information Portal, the portal’s content and layering, the substituted notice and legitimate-interest assessments.

1. Appeal dismissed. The Upper Tribunal found no error of law in the First-tier Tribunal’s decision.
2. The appellate court must distinguish errors of law from disagreement with a first-instance evaluative assessment. It must not re-perform a multifactorial assessment merely because it might have reached a different conclusion. Intervention requires an identifiable flaw such as a significant error of principle, a gap in logic, inconsistency or failure to take account of a material factor.
3. The First-tier Tribunal had addressed Article 5(1)(a) GDPR in substance. The fact that it did not expressly repeat that provision in its conclusions was not decisive when the decision was read as a whole. The transparency obligation is distinct from, and may extend beyond, the specific information duties in Articles 13 and 14.
4. Transparency is context-specific and proportionate. The relevant context included the scale and nature of the processing, the use of modelled data, its consequences, data subjects’ reasonable expectations, the Article 21(2) right to object and the cost of further compliance. Objective reasonable expectations were relevant; a subjective reaction of surprise was not a sufficient yardstick.
5. Article 14(5)(a) is not confined to information physically read or supplied in hard copy. Whether a data subject already has the prescribed information is a question of fact and degree, particularly involving accessibility and clarity. A hyperlink or series of hyperlinks may suffice, but the exception is not established merely because some route to the information exists.
6. The First-tier Tribunal was entitled to conclude that the CRAIN and linked Consumer Information Portal provided an adequately clear and accessible route for the main cohort. The same conclusion could properly be inferred for data obtained through third-party suppliers. Article 14(5)(b) did not require separate consideration for that cohort because Article 14(5)(a) applied.
7. The First-tier Tribunal had found an Article 14 breach for the residual cohort. Its conclusion that direct notification at that stage would be disproportionate, and its rejection of the requirement to re-conduct legitimate-interest assessments for the main cohort, were adequately reasoned when the decision was read as a whole.
8. The First-tier Tribunal’s observations that notification of the residual cohort might cause disinterest or confusion were obiter and hypothetical in relation to the main cohort.

• Upper Tribunal (Administrative Appeals Chamber): The Information Commissioner’s appeal against the First-tier Tribunal decision was dismissed. [2024] UKUT 105 (AAC)
• First-tier Tribunal (General Regulatory Chamber): Experian’s appeal against the enforcement notice was allowed in large part. A substituted enforcement notice was issued. [2023] UKFTT 00132 (GRC)