“Experian is a well-known Credit Reference Agency (“CRA”). In that capacity it holds and processes data relating to over 51 million people living in the United Kingdom, effectively the whole of the adult population. What is less well known is that Experian has within it a business unit, Experian Marketing Services (“EMS”), which processes the data of around 51 million people in the UK to provide marketing services which it sells to its third-party clients. It does so by combining their name and address information, with a total of up to thirteen actual attributes. It then processes this data and creates modelled information on the demographic, social, economic and behavioural characteristics of these 51 million individuals on a predictive basis, the profile for each person running to as many as 49 derived data points about individuals and up to 370 modelled points about individuals, with each profile running to many pages.”
“2. The enforcement notice relates to Experian’s processing of personal data for marketing services for its offline, not online, marketing services. 3. The direct marketing services business is operated by EMS, which is a separate business unit within Experian but is not a separate legal entity. For that reason, we refer in this decision to Experian, not EMS, as it is the legal entity which is the appellant. Broadly, Experian does not carry out marketing in its own name, but its data processing furthers the direct marketing of third parties, that is, Experian’s customers. 4. For the purpose of the EMS business, Experian acquires the personal data of individual data subjects from a variety of sources in broadly three strands. It obtains publicly available information from sources such as the Open Electoral Roll (“OER”), Companies House and the register of County Court Judgments. It also acquires data from third parties such as Gardeners’ Club. It also acquires data from its CRA business. It does not process the data from these three strands in the same way. 5. Experian processes the data to create three different products which are relevant to the notice and the appeal: ConsumerView, ChannelView and Mosaic. There is, in addition to those services, a credit pre-screening product that uses some elements of CRA data only offered to members of Credit Account Information Sharing service (“CAIS”). 6. Broadly, Experian has no direct relationship with individuals whose data it processes for the purpose of these products, except in a limited number of cases when individuals contact Experian via the Experian website or where they have a direct relationship with Experian via Experian Consumer Services (“ECS”). 7. ConsumerView contains entries at an individual level for some 51 million adults in the United Kingdom, that number changing from time to time due to changes in the UK adult population, as a result of deaths and people turning 18. ConsumerView combines name and address information, with a total of up to thirteen actual attributes. It then processes this data and creates modelled information on the demographic, social, economic and behavioural characteristics of individuals and households on a predictive basis. The actual information reflects known characteristics of a given individual; the derived information reflects characteristics that are calculated or ascertained from other data, the modelled information reflecting predicted characteristics. 8. ChannelView’s database contains names, postal addresses, email addresses and mobile phone numbers are predominantly provided to Experian by various third data suppliers who between them collect data from data subjects via some 148 websites in return for access to offers and discounts, price comparison services, the ability to participate in surveys and so on. The total number of records will vary from time to time, but it contains details of at least 24 million individuals. 9. Mosaic uses data from public and commercial sources in order to attribute households into fifteen overarching groups, 66 household types and 155 person types. Some of the information through which Mosaic is created is taken from the individual profiles on ConsumerView but there are other non-personal data sources which read into that. Mosaic codes are appended to the individual level profiles within ConsumerView. CRA-Derived Data 10. Experian uses data derived from Experian’s CRA business in the following ways: (1) to add names and addresses to ConsumerView (about 25.1 million individuals are added to ConsumerView by this route); (2) to ensure the accuracy of the 25.9 million prospectable records included in ConsumerView; (3) to match and link records from different sources; (4) to build the derived and modelled attributes within ConsumerView. In this context, “prospectable” means that a name and postal address will be shared by EMS with customers who do not already have that name and address, to help those customers reach new business and supporters. Others are non-prospectable which means that the name and address data will not be shared in this way, but information concerning them can be shared with customers who already have those individuals name and address. Experian treats the records obtained from the CRA as “non-prospectable”
“141. ConsumerView is, as is noted above, a product which combines the name and address information for some 51 million UK adults with predicted socio-economic and behavioural characteristics. Not all of the profiles will contain the maximum number of thirteen actual attributes and many of those are obtained from sources which are publicly accessible such as the open electoral register, the Registry Trust (in respect of county court judgments), and Companies House. Three data points (buildings insurance renewal month, contents insurance renewal month and motor insurance renewal month) are not derived from public sources and one data point, that is prospectable, being a person’s date of birth, can be derived either from a public source (the OER) or from a non-public source such as a third party suppliers. … 144. We accept, as is clear from the sample profiles shown to us, that ConsumerView profiles will include up to 49 derived data points about individuals and up to 370 modelled points about individuals. These are, as Experian submits, predictions about the likelihood of people having certain characteristics. … … 146. … It is important to note that the data obtained via CRA is not prospectable. We note also Ms Shearman’s evidence that data may be marked as non-prospectable if individuals appear on Experian’s NMR file or other industry suppression files such as mail preference and telephone preference. That said, if an individual is marked as non-prospectable, then that will not affect the nature and range of that data that is held about the person unless they apply to have their data removed which, as the evidence demonstrates, applies only to a very small number of people. 147. With regard to how the ConsumerView database is used by clients of Experian, if they send a list of individual names and ask Experian to enrich it from the ConsumerView database, Experian will use both prospectable and non-prospectable records in answering the request albeit that the information provided to the customer will only have attributes and propensities added and not the name and address (unless of course this is already held). In other circumstances, Experian’s clients may request records containing those attributes and propensities which are of most relevance to their organisation, e.g. whether a customer is more or less likely than average to be interested in direct mail, or what age group they might be in. In response, Experian will provide such clients with prospectable records. 148. The information held on ChannelView is predominately provided to Experian by various third-party data suppliers … It is used in order to link information held in ConsumerView with records provided to Experian by its customers and suppliers.”
“Category A 1) Revise the CIP to: a) set out clearly in one place and at the forefront of the privacy information an "at a glance" summary of the direct marketing processing that Experian undertakes, including what attributes (actual and modelled) Experian processes about individual data subjects; b) place information that is likely to surprise individuals (for example, that connect together multiple data sources to build a marketing profile) more prominently than in the third or fourth layers; c) include language concise, clear and not unduly euphemistic or industry-based language (such as "insight") to ensure it is intelligible to data subjects; and d) include intelligible information about each source of data (including modelled data), each use of data and the onward disclosure of data and illustrate them with examples and possible outcomes.”
“Category B 4) Directly provide all data subjects with an Article 14-compliant privacy notice (by mail or other acceptable means of communications) where Experian has acquired their personal data from any source other than the data subject, which clearly and directly informs the data subject that their personal data has been obtained by Experian for purposes which include direct marketing and the form that processing for marketing purposes takes, in terms and form consistent with paragraph 1) above (save that no notice is required to be sent where Experian's processing concerns only the retention or sale of the Open Electoral Register and no other processing of the personal data in that Open Register has occurred, or relates to the obtaining and use of directory enquiry databases like BT OSIS or suppression databases like the TPS). 5) Cease the processing of the personal data of any data subject to whom an Article 14-compliant notice is not sent. Category C 6) Cease processing any personal data where the objective legitimate interest assessment cannot be said to favour the interests of Experian, having particular regard to the transparency of the processing and the intrusive nature of profiling. 7) In the case of all suppliers of personal data to Experian, review the compliance with the GDPR of the privacy notices and data capture mechanisms of those suppliers and collect data from only those suppliers where it is the case that: a) the suppliers' notices provide the same standard of transparency as the CIP, b) the suppliers' consent capture mechanisms are sufficient to constitute valid consent (including being informed and specific) to the collection, disclosure and onward processing of the data; and c) the suppliers' privacy information is clear and intelligible, with processing that the individual is unlikely to expect or would be surprised by to the fore and not buried in lengthy and jargon-heavy text. 8) Cease the processing of any personal data where there is insufficient evidence that it was collected in a compliant manner.”
“119. We accept the Information Commissioner’s submission that the right to transparency in the processing of personal data is foundational as it enables data subjects to access and exercise their own GDPR rights. We accept it is essential to affording data subjects autonomy and to achieving the purpose of the GDPR that a person should have control of their own personal data. ... 121. With respect to the requirements of transparency, we find that Mr Hulme’s evidence on this makes little sense. Given how it is defined, what is or is not transparent will be fact-specific and context related. The level of transparency required, for example, when sharing intimate health details will not be the same as people consenting to the processing of, for example, data about their preferred supermarket. … 128. Whilst we understand why counsel for the Information Commissioner would wish to distance himself from Mr Hulme’s evidence, nonetheless, it has the effect of there being little or no evidence to support some of the positions taken in the enforcement notice; and, for reasons to which we will turn below, there are a number of factual errors identified in the enforcement notice. In addition, in his cross-examination Mr Hulme accepted that the scenarios set out in his witness statement as to how people would be distressed by the data processing were incorrect to the extent that he accepted his evidence in his witness statement was “completely wrong, completely misleading and perverse”
“133. We accept that Experian’s credit reference agency business is well-known. We take notice of the fact that we have observed marketing carried out on television and on billboards. We consider, however, that it would be speculative to consider how well-known their marketing business, EMS, is. We note Mr Grieves’ evidence that Experian presents itself as a business that processes credit data, sharing data and providing access to offers. We note the submission that over 17 million individuals will have interacted with third party websites that supply data to Experian and will thus have seen the reference to the Experian privacy notice, but we do not accept that that is good evidence that that number of people will be aware of EMS. That is because of the other evidence, on which Experian relies. We accept also that approximately 10 million people will have been notified of the existence of Experian if they had been in direct contact with ECS but how much that impinged on their awareness we do not know.”
“135. The core of the Information Commissioner’s case is that the processing undertaken by Experian will be surprising to those individuals whose personal data is processed, the processing is intrusive, and that the assessments undertaken in balancing Experian’s legitimate interests are flawed. 136. We found Mr Hulme’s evidence to be significantly flawed in a number of respects. As noted above he accepted that in certain core parts of his evidence what he had said in his witness statement was not just wrong but that the position was in fact the direct opposite of what he had said in that witness statement to which his statement of truth had been appended. … 138. We accept the submission that in order for weight to be attached to the Information Commissioner’s opinion that it has to be based in evidence. We accept also that in reaching a decision, the Commissioner and this panel must have regard to the regulatory decisions in respect of the economy, the environmental impact and positive benefits for the consumers of processing (which appear from Mr Hulme’s evidence not to have been taken into account in the enforcement notice).”
“142. It is part of the Information Commissioner’s case that individuals on the OER would find Experian’s use of their data surprising. The source for that is primarily Mr Hulme whose evidence is, for the reasons set out above, less than reliable. It is not in reality grounded in evidence but is supposition. Further, the mere fact that some people might subjectively find some things “surprising” is not a particularly useful yardstick.”
“145. We bear in mind the evidence, as accepted to an extent by Mr Hulme, that modelled data points may not in fact reflect a person’s actual characteristics. This, we find, makes them less intrusive than processing actual data...”
“152. We accept that the CRA-derived data is used to validate or update address data, and in the creation of Experian’s models. It is important to note that EMS does not have access to any account transaction data. We accept the evidence that there are benefits to data being used in such a way. It ensures that the mailing lists are up-to-date, which in turn means that mailing is not sent to former addresses which may in itself be problematic if it were then to be accessible by those who should not have access to it, depending on what material is in a mailshot. We accept also that it has a utility in that it allows businesses to, as Experian’s evidence indicates, cut down on duplicate names, misspellings and similar errors. There are therefore benefits to this. We note that Mr Hulme accepted these were benefits, and we note that offering a service to check accuracy is supporting compliance with the accuracy principle. 153. Looking at the evidence as a whole we consider that the Information Commissioner did not properly appreciate the limited extent to which CRA data was used. However, we do note that this source of data is used to produce the ConsumerView profiles even if the address information is not prospectable. The CRA data is therefore, to an extent, used in the building up of Experian’s products. 154. We consider that the credit pre-screening product is of use in that it removes people from marketing lists for credit products in circumstances where they would likely to be declined as is the evidence from Experian’s witnesses. We accept that this does not prevent people from applying for the credit product, merely that material is not sent to them. We consider that there is a utility in this because it means that they will not be offered products which (a) might not be affordable for them (b) where a refusal may cause difficulties for their credit score with an ongoing difficulty, spiralling, in obtaining credit... We accept that the FCA does not require firms to process data held by CRA to screen people out, but Experian has never said that that is a requirement, and we note that the PRA and the FCA have confirmed that the service offered is beneficial and helps lenders comply with the FCA’s rules which we consider is a matter in the public interest. 155. We do not accept the emotive evidence from Mr Hulme that the use of CRA data to screen individuals stigmatises poor people... 156. We accept also Experian’s submission that what its clients are seeking to do is not to target particular individuals but merely to have a list of those who are more likely to respond to the offer their client intends to send. That is to say that the chances of direct mail marketing being effective are higher by sending mail to a list of individuals who may have particular characteristics, which is better than sending them at random. Experian’s customers are, we accept, interested in the aggregated picture and we bear in mind that this is not a situation, unlike some direct online marketing, where the buying habits of particular individuals are known. We accept Mr Grieves’s evidence that retailers do not pore over the names and addresses from ConsumerView. 157. With regard to the amount of data sent out, we accept the evidence from Experian that on average four attributes are provided to clients; that data representing the last twenty attributes and that impact of this fact is that they do not sell the entire data profile of a cohort of data subjects. We accept Ms Shearman’s evidence that each disclosure of data by Experian to a client is considered on a case-by-case basis subject to controls including whether it is to be used for a permitted purpose as agreed in the contract. We accept also that there is some auditing of the use to which the data is put and Experian contracts with data brokers contain audit rights requiring the brokers to provide monthly reports on the use of data. We accept also that there are red and amber lists of organisations with whom Experian will not do business or may well not do business, and we note the evidence that the only gambling company which is a customer of Experian uses the service to prevent underage people from gambling. One might have thought that was in the public interest but that too must be balanced. 158. We consider it difficult to quantify how much material would or would not be sent if Experian’s activities were curtailed. We consider the suggestion that Experian’s products help stop one billion communications to be excessive and not properly sourced in evidence. We accept Mr Grieves’ evidence that some of the suppression services may act to prevent stress in certain circumstances and we note, worryingly, that Mr Hulme accepted that proposition and, in the example, whereby marketing was sent to pregnant mother who had suffered a miscarriage that his statement was perverse, wrong and misleading in this regard. 159. With regard to the evidence whereby those who might be in fuel poverty are identified, and the suggestion that may be problematic, we note that such data might, if used by utility companies and relevant service providers be in the public interest. 160. Finally, we accept the submission that the worst outcome of Experian’s processing in terms of what happens to the data at the end of the process is that an individual is likely to get a marketing leaflet which might align to their interests rather than be irrelevant. To some extent we accept that the effect of suppression lists and removing certain types of data may result in some people not receiving distressing or inappropriate communication. That does not of course mean that there has been compliance with the DPA or the GDPR but, following Lloyd v Google LLC[2021] UKSC 50 , it is unlikely that there would, in this scenario, be a data subject who is likely to succeed in a damages claim.”
“CRAIN 161. The route for an individual to learn what happens to data acquired via the CRA involves following a link from material supplied by, for example, a bank to the CRAIN and from there to the CIP maintained by Experian. The great majority of lenders make the CRAIN available to individuals by providing them with a link from their own privacy notice. We accept Experian’s position that this route was decided after consultation with the Information Commissioner. The Information Commissioner were also, we accept in the light of the evidence of Mr Cresswell and Mr Hulme, involved in the development of the CRAIN and considered that it was a good transparency notice. We find, examining it that it provides individuals with an understanding of Experian’s business and links to further material. 162. The route noted above will usually be facilitated by hyperlinks if the material from the bank, as is often the case, is supplied in electronic form. We consider that the reasonable data subject will be familiar with hyperlinks and how to follow them. Consumer Information Portal 163. We were taken at length through the consumer information portal (CIP) which we accept now includes a freestanding notice collating the information required to be provided by Article 14. That was introduced in October 2020 at the same time as the issue was noticed by the Information Commissioner. It has been amended so that it no longer pops up only on a user’s first visit but also on subsequent visits to the site. 164. The Information Commissioner’s case is that Experian made no attempt to identify the information that individuals were likely to find concerning or surprising and did not address its mind to the questions of what steps it should take to ensure the information was promptly located in the CIP. 165. Stepping back from the particular circumstances of this case, there is a tension between providing large amounts of information on the one hand with the aim of improving transparency and accessibility of information and on the other the resultant information overload. To an extent that is met by layering which is the staggering of provision of information to the customer, which is more easily adapted to a website scenario. That is because an individual accessing it can see headlines and click on them for more information. Whether, and to what extent, a particular piece of information is surprising or for that matter important or unusual will be a matter of judgment. It is self-evident that not all users will take the same view, nor will their knowledge as to how data is processed in general be the same. Put bluntly, what surprises one person may not surprise another but what is in issue is an individual’s reasonable expectations. 166. We accept the evidence that Experian’s website receives some 7 million visits per month but equally that only 130,000 unique IP addresses have visited the CIP since April 2018. There is no evidence regarding the number of visitors to the CIP who have gone beyond the first layer. This is borne out to an extent by the research data which shows that actually most people do not care about what happens to their data. 167. With regard to the opt out option we do not consider that people are improperly pushed towards not opting out totally. 168. We note the evidence that a report from the Competition & Markets Authority suggests that on average individuals spend 73 seconds reading a privacy policy. In that context, it is more likely than not that most people will not assimilate the substance of the entire policy in that time. That is of course a matter of individual choice. 169. Common sense would tend to suggest that it is only those who are actually interested in what happens to their data who would read beyond the first part of a privacy notice and, if they were concerned to read further, we consider that there is a sufficiently easy to follow trail through hyperlinks to the CIP from the privacy notices which enables people who are concerned about their privacy to follow that route to learn more. If people are not concerned about their privacy or what happens to their data, and they must be assumed to know those people are going to process it, then to a significant extent that is their choice. It may not be the choice of others or particularly data professionals but you cannot force people into reading privacy policies and the data controller is still obligated to provide a privacy notice. The processing must still be fair, lawful and transparent. Compliance with Data Protection law is the core focus and function of the Information Commissioner and therefore the Tribunal on appeal. 170. There are, we consider, difficulties with the basis upon which data obtained by third-party suppliers was previously processed by Experian. We do, however, note the evidence that the model used is now that data is processed on the basis of legitimate interests and not on the basis of consent. That issue would thus appear now to be academic.”
“172. We turn next to whether, in the light of these findings, Experian has failed to comply with the GDPR as the Information Commissioner claims. 173. The Enforcement Notice required Experian to provide all data subjects with an article 14 GDPR compliant privacy notice and to cease processing the personal data of any data subject to whom an article 14 compliant notice has not been sent. 174. Experian, in ground 4 of its appeal, says that the requirements of the Enforcement Notice are disproportionate and unfair. The Information Commissioner says that the requirement of transparency is a high-level obligation. 175. The Tribunal finds that transparency is central to the GDPR. The relevant transparency requirement here is the requirement to provide an article 14 notice. The GDPR is clear about the limited circumstances in which the requirement to give an article 14 notice may be avoided. … 176. The Tribunal was presented with some difficulty in assessing the historic position in terms of what the CIP actually said at the time the Enforcement Notice was issued by the Information Commissioner because Experian had made changes during negotiations with the Information Commissioner in the course of the investigation. We note that the position is that both articles 13 and 14 lay down a timescale for the provision of privacy notices. Neither party assisted us on the issue of the relevant version for us to consider. 177. We do not consider that the Information Commissioner has provided us with evidence that would allow us to conclude that the CIP was defective at the time of the enforcement notice. We note also the relevance of the current position to the steps which the Tribunal may now order. We find that the processing, so far as it relates to CRA derived data, is now sufficiently transparent in the context of the privacy notices which are served on those data subjects who provide CRA data to lenders. The hyperlinks and websites are simple to follow, and we find, having considered the CIP in detail, that in its current form, as provided to us, it is adequately clear. We do accept that the scale of the processing undertaken is very large, and that is something which would be surprising to data subjects as indeed would be the uses to which that data is put when considering the purposes for which it was collected. But, having considered the CIP, we consider that the relevant information is sufficiently prominently displayed and accessible to data subjects who want to understand how their data will be processed.”
“178. Experian has accepted that around 5.3 million data subjects, out of the circa 51 million data subjects whose information is processed by Experian, have not received a privacy notice but contends that Experian can rely on paragraph 5 of article 14 on the basis that the provision of such information would involve a disproportionate effort. The GDPR is clearly written so that the article 14 privacy notice requirement cannot be easily avoided and so that ‘disproportionate effort’ is to be construed narrowly. Whilst we note that we are not bound by it, we have had regard to the Article 29 Working Party guidance on Transparency as adopted by the European Data Protection Board. In the context of the GDPR, the fact that notifying the 5.3 million data subjects would involve a considerable business expense does not mean that it would be a disproportionate effort for the purposes of article 14 GDPR. That is a business expense which should have been incurred over time as a matter of routine compliance. If the costs of compliance were higher than Experian considered acceptable, then Experian was free to take a business decision not to undertake the processing. We find that Experian should have provided the residual cohort with an article 14 privacy notice and did not do so. It was therefore non-compliant in that respect. 179. On that basis, we find that there has been a contravention of the GDPR in respect of that cohort in that the processing has not been transparent, fair or lawful.”
“180. We find also that there has, in the past, been a contravention of the GDPR with respect to the data obtained from third-party suppliers where that material was obtained on a consent basis, and we do not accept that legitimate interests is a proper means by which that data could have been used by Experian for the purpose it was processed. But we accept that this no longer occurs.”
“181. We do not find that there has been any other material contravention.”
“183. In so doing, we must stand in the shoes of the Information Commissioner and ask whether the Information Commissioner should have exercised her discretion differently. A broader concept of proportionality comes into the exercise of discretion by the Information Commissioner which involves a consideration of what could be achieved by imposing a requirement that Experian should rectify its non-compliance by providing a privacy notice to the residual cohort. The answer to that question is that it would be informing the data subjects about the use of their personal data as they were entitled to be informed previously and that this could enable them to object if they so wished. It would also prevent Experian from benefitting from non-compliance by having saved business costs by not providing an article 14 notice. It would also potentially dissuade other Data Controllers from non-compliance, but the main object of the enforcement notice would be to make sure that Experian would comply with the GDPR in the future. 184. We find that the Information Commissioner should have exercised her discretion differently in that she should have balanced the objectives in issuing the enforcement notice against (a) the fact that the uses to which the personal data were put did not result in adverse outcomes for the data subjects, (b) the economic impact that the expense would have on Experian when incurred at once rather than over months or years, and (c) the likely reaction of the data subjects to receiving an ‘out of the blue’ notification, which reaction we find was likely to be either disinterest resulting, for example, in the data subject just putting it in the bin or possibly some confusion or even distress. We are satisfied that the Information Commissioner got the balance wrong in terms of proportionality in exercising her discretion because the Information Commissioner had fundamentally misunderstood the actual outcomes of Experian’s processing. We note in particular that section 150(2) provides ‘In deciding whether to give an enforcement notice in reliance on section 149(2), the Information Commissioner must consider whether the failure has caused or is likely to cause any person damage or distress’. 185. The Tribunal must also consider what steps it will order now, and we find that to order notification of the residual cohort now would be disproportionate. However, the Tribunal would stress that it has made a finding that Experian did not comply with the requirements of article 14 and it fully expects that Experian will rectify this non-compliance in respect of its future personal data collections. The Tribunal recognises the considerable expense and practical difficulties which Experian would face in attempting to identify the residual cohort and issue them with an article 14 notice. 186. The Tribunal is cognisant of the fact that some of the personal data has been used to build models from which Experian may continue to derive a commercial benefit. Any processing of personal data collected in circumstances where an article 14 privacy notice should have been given and has not been given will continue to be non-compliant and Experian should consider what it can do to discontinue this processing. This applies even where the personal data has ceased to be personal data because its inclusion in the models is anonymised. It is clear that taking personal data and anonymising it is a form of processing of personal data and that processing must be compliant. However, the Tribunal cannot order steps which are unclear or incapable of implementation. 187. The Tribunal is also satisfied that it is unlikely that any person has suffered damage or distress as a result of Experian’s failure to provide an article 14 notice.”
“SUBSTITUTE DECISION NOTICE 1. By the date that is three months after the date of this decision (the “Relevant Date”), Experian must set up a system that enables it to provide all data subjects whose personal data is obtained by Experian from one or more of the Open Electoral Register, the Registry Trust Limited or Companies House (those data subjects being the “Relevant Data Subjects, and those sources together being the "Open Sources”) with a privacy notice (a “Relevant Notice”). 2. The Relevant Notice must: (i) inform the Relevant Data Subject that their personal data has been obtained by Experian and is being processed by it for direct marketing purposes, and (ii) otherwise comply with Article 14 of the UK GDPR. For the avoidance of doubt: (a) A Relevant Notice may be provided to the Relevant Data Subject by Experian either (i) through any form of direct communication by Experian with the Relevant Data Subject (e.g. through the post or, if Experian has the relevant contact details for the Relevant Data Subject, via email or text message) or (ii) through the medium of the notifications given to Relevant Data Subjects by the Open Sources. (b) No Relevant Notice is required to be sent where: (i) Experian has obtained personal data about the Relevant Data Subject from its CRA business, its consumer services business or from third party commercial suppliers, or (ii) Experian’s processing of the personal data of the data subject is confined to the retention or sale of the Open Electoral Register, or (iii) Experian’s processing of the personal data of the data subject relates solely to the obtaining and use of directory enquiry databases such as BT OSIS or suppression databases like the TPS, or (iv) Experian ceases to process personal data about the data subject for direct marketing purposes at any time prior to the point at which, pursuant to this Substitute Enforcement Notice, a Relevant Notice would otherwise be required to be sent to the data subject. 3. Subject to paragraph 2 above, the Relevant Notices must be sent to the Relevant Data Subjects as follows: (a) Within twelve months of the Relevant Date, Experian must provide a Relevant Notice to all data subjects whom it identified as being Relevant Data Subjects as at the Relevant Date. (b) In circumstances where Experian obtains personal data from the Open Sources in respect of data subjects who: (i) were not identified by Experian as having been Relevant Data Subjects as at the Relevant Date, but (ii) are identified by Experian as being new Relevant Data Subjects, Experian must provide those individuals with a Relevant Notice. 4. Nothing in this Enforcement Notice requires Experian to provide more than one Relevant Notice to a Relevant Data Subject. 5. No financial penalty is imposed.” (Emphasis in the original text.)
“The Correct Approach on Appeal 46. This is another important matter, and it is appropriate to summarise the correct approach at this stage. A finding that an activity is or is not targeted at consumers in the UK necessarily involves an evaluation by the judge of a range of different facts and matters. It requires, in other words, a multifactorial assessment of the documents, the evidence and the submissions made by the parties. The evaluation is also one which, when made in that way, the trial judge is peculiarly well placed to carry out. 47. Conversely, an appeal court is inevitably at a disadvantage, as Lord Hoffmann explained in Biogen Inc v Medeva plc[1997] RPC 1 at 4, and so, where the application of a legal standard such as negligence or obviousness involves no question of principle, but is simply a matter of degree, an appellate court should be very cautious in differing from the judge’s evaluation. 48. We consider that the position was well summarised by Lewison LJ in Fage UK Ltd v Chobani UK Ltd[2014] EWCA Civ 5 ;[2014] FSR 29 ; [2014] ETMR 26 in these terms at para 114: “Appellate courts have been repeatedly warned, by recent cases at the highest level, not to interfere with findings of fact by trial judges, unless compelled to do so. This applies not only to findings of primary fact, but also to the evaluation of those facts and to inferences to be drawn from them. The best known of these cases are: Biogen Inc v Medeva plc [1977] R.P.C. 1; Piglowska v Piglowski [1999] 1 W.L.R. 1360; Datec Electronics Holdings Ltd v United Parcels Service Ltd[2007] UKHL 23 ; [2007] 1 W.L.R. 1325; In re B (A Child) (Care Proceedings: Threshold Criteria)[2013] UKSC 33 ; [2013] 1 W.L.R. 1911 and, most recently and comprehensively, McGraddie v McGraddie[2013] UKSC 58 ;[2013] 1 WLR 2477 . These are all decisions either of the House of Lords or of the Supreme Court. The reasons for this approach are many. They include: i) The expertise of a trial judge is in determining what facts are relevant to the legal issues to be decided, and what those facts are if they are disputed. ii) The trial is not a dress rehearsal. It is the first and last night of the show. iii) Duplication of the trial judge’s role on appeal is a disproportionate use of the limited resources of an appellate court, and will seldom lead to a different outcome in an individual case. iv) In making his decisions the trial judge will have regard to the whole of the sea of evidence presented to him, whereas an appellate court will only be island hopping. v) The atmosphere of the courtroom cannot, in any event, be recreated by reference to documents (including transcripts of evidence). vi) Thus even if it were possible to duplicate the role of the trial judge, it cannot in practice be done.” 49. That does not, however, mean the appeal court is powerless to intervene where the judge has fallen into error in arriving at an evaluative decision such as whether an activity was or was not targeted at a particular territory. It may be possible to establish that the judge was plainly wrong or that there has been a significant error of principle; but the circumstances in which an effective challenge may be mounted to an evaluative decision are not limited to such cases. Many of the important authorities in this area were reviewed by the Court of Appeal in In re Sprintroom Ltd[2019] EWCA Civ 932 ;[2019] BCC 1031 , at paras 72–76. There, in a judgment to which all members of the court (McCombe LJ, Leggatt LJ and Rose LJ) contributed, the court concluded, at para 76, in terms with which we agree, that on a challenge to an evaluative decision of a first instance judge, the appeal court does not carry out the balancing exercise afresh but must ask whether the decision of the judge was wrong by reason of an identifiable flaw in the judge’s treatment of the question to be decided, such as a gap in logic, a lack of consistency, or a failure to take into account some material factor, which undermines the cogency of the conclusion. 50. On the other hand, it is equally clear that, for the decision to be “wrong” underCPR 52.21 (3), it is not enough to show, without more, that the appellate court might have arrived at a different evaluation.” “Appellate courts have been repeatedly warned, by recent cases at the highest level, not to interfere with findings of fact by trial judges, unless compelled to do so. This applies not only to findings of primary fact, but also to the evaluation of those facts and to inferences to be drawn from them. The best known of these cases are: Biogen Inc v Medeva plc [1977] R.P.C. 1; Piglowska v Piglowski [1999] 1 W.L.R. 1360; Datec Electronics Holdings Ltd v United Parcels Service Ltd[2007] UKHL 23 ; [2007] 1 W.L.R. 1325; In re B (A Child) (Care Proceedings: Threshold Criteria)[2013] UKSC 33 ; [2013] 1 W.L.R. 1911 and, most recently and comprehensively, McGraddie v McGraddie[2013] UKSC 58 ;[2013] 1 WLR 2477 . These are all decisions either of the House of Lords or of the Supreme Court. The reasons for this approach are many. They include: i) The expertise of a trial judge is in determining what facts are relevant to the legal issues to be decided, and what those facts are if they are disputed. ii) The trial is not a dress rehearsal. It is the first and last night of the show. iii) Duplication of the trial judge’s role on appeal is a disproportionate use of the limited resources of an appellate court, and will seldom lead to a different outcome in an individual case. iv) In making his decisions the trial judge will have regard to the whole of the sea of evidence presented to him, whereas an appellate court will only be island hopping. v) The atmosphere of the courtroom cannot, in any event, be recreated by reference to documents (including transcripts of evidence). vi) Thus even if it were possible to duplicate the role of the trial judge, it cannot in practice be done.”
“The approach to be followed in perversity challenges to decisions of specialist Tribunals … is simply a reflection of the respect which is naturally paid to the decisions of a specialist Tribunal in an area where it possesses a particular expertise. Given such expertise in a Tribunal, it is entirely understandable that a reviewing court or Tribunal will be slow to interfere with its findings and evaluation of facts in areas where that expertise has a bearing. This may be regarded not so much as requiring that a different, enhanced standard must be met as an acknowledgement of the reality that an expert Tribunal can normally be expected to apply its expertise in the course of its analysis of facts ….”
“Essentially, the judicial task is twofold: to enable the parties to understand why they have won or lost; and to provide sufficient detail and analysis to enable an appellate court to decide whether or not the judgment is sustainable.”
“ … It has also been recognised that a generous interpretation ought to be given to a tribunal’s reasoning. It is to be expected, of course, that the decision will set out the facts. That is the raw material on which any review of its decision must be based. But the quality which is to be expected of its reasoning is not that to be expected of a High Court judge. Its reasoning ought to be explained, but the circumstances in which a tribunal works should be respected. The reasoning ought not to be subjected to an unduly critical analysis.”
“26. Where permission is granted to appeal on the grounds that the judgment does not contain adequate reasons, the appellate court should first review the judgment, in the context of the material evidence and submissions at the trial, in order to determine whether, when all of these are considered, it is apparent why the judge reached the decision that he did. If satisfied that the reason is apparent and that it is a valid basis for the judgment, the appeal will be dismissed. … If despite this exercise the reason for the decision is not apparent, then the appeal court will have to decide whether itself to proceed to a rehearing or to direct a new trial. …. 118. ... There are two lessons to be drawn from these appeals. The first is that, while it is perfectly acceptable for reasons to be set out briefly in a judgment, it is the duty of the judge to produce a judgment that gives a clear explanation for his or her order. The second is that an unsuccessful party should not seek to upset a judgment on the ground of inadequacy of reasons unless, despite the advantage of considering the judgment with knowledge of the evidence given and submissions made at the trial, that party is unable to understand why it is that the judge has reached an adverse decision.”
“1. Where personal data have not been obtained from the data subject, the controller shall provide the data subject with the following information: (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation ... 2. In addition to the information referred to in paragraph 1, the controller shall provide the data subject with the following information necessary to ensure fair and transparent processing in respect of the data subject: (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) ... (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 3. The controller shall provide the information referred to in paragraphs 1 and 2: (a) within a reasonable period after obtaining the personal data ... ... 4. ... 5. Paragraphs 1 to 4 shall not apply where and insofar as: (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the condition and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available; (c) ... (d) ...” (a) the identity and the contact details of the controller and, where applicable, of the controller’s representative; (b) the contact details of the data protection officer, where applicable; (c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (d) the categories of personal data concerned; (e) the recipients or categories of recipients of the personal data, if any; (f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation ... (a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party; (c) the existence of the right to request from the controller access to rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability; (d) where processing is based on point (a) of Article 6(1) ... (e) the right to lodge a complaint with a supervisory authority; (f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources; (g) the existence of automated decision making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. (a) within a reasonable period after obtaining the personal data ... ... (a) the data subject already has the information; (b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the condition and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available; (c) ... (d) ...”
“However, it is not necessary to impose the obligation to provide information where the data subject already possesses the information ….”
“Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.”
“190. Thus, it is apparent that, under the GDPR, transparency is envisaged as an overarching concept that governs several provisions and specific obligations... 191. ... it is important to differentiate between obligations stemming from the principle of transparency and the principle itself. The text of the GDPR makes this distinction, by enshrining transparency as one of the core principles under Article 5(1)(a) GDPR on the one hand, and assigning specific and concrete obligations linked to this principle, on the other one... 192. On the basis of the above considerations, the EDPB underlines that the principle of transparency is not circumscribed by the obligations under Articles 12-14 GDPR, although the latter are a concretisation of the former. Indeed, the principle of transparency is an overarching principle that not only reinforces other principles (i.e. fairness, accountability) but from which many other provisions of the GDPR derive... 193. That being said, the EDPB is of the view that an infringement of the transparency obligations under Articles 12-14 GDPR can, depending on the circumstances of the case, amount to an infringement of the transparency principle.”
“4. Transparency, when adhered to by data controllers, empowers data subjects to hold data controllers and processors accountable and to exercise control over their personal data by, for example, providing or withdrawing informed consent and actioning their data subject rights. The concept of transparency in the GDPR is user-centric rather than legalistic and is realised by way of specific practical requirements on data controllers and processors in a number of articles. The practical (information) requirements are outlined in Articles 12-14 of the GDPR. However, the quality, accessibility and comprehensibility of the information is as important as the actual content of the transparency information, which must be provided to data subjects. … 10. A central consideration of the principle of transparency outlined in these provisions is that the data subject should be able to determine in advance what the scope and consequences of the processing entails and that they should not be taken by surprise at a later point about the ways in which their personal data has been used. This is also an important aspect of the principle of fairness under Article 5(1) of the GDPR and indeed is linked to Recital 39 which states that “[n]atural persons should be made aware of risks, rules, safeguards and rights in relation to the processing of personal data...”