FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(Information Rights)
NCN: [2023] UKFTT 00132 (GRC)
Appeal Number: EA/2020/0317
Heard via CVP & in person
17, 19 -21 & 31 January 2022 & 11 February 2022
Decision given on: 20 February 2023
Before
UPPER TRIBUNAL JUDGE RINTOUL
(SITTING AS A JUDGE OF THE FIRST-TIER TRIBUNAL)
FIRST-TIER TRIBUNAL JUDGE GRIFFIN
TRIBUNAL MEMBER K GRIMLEY EVANS
Between
EXPERIAN LIMITED
Appellant
– and –
THE INFORMATION COMMISSIONER
Respondent
Representation:
For the Appellant: Ms A Proops KC and Mr R Hopkins, instructed by Linklaters LLP
For the Respondent: Mr T Pitt-Payne KC and Mr C Knight, instructed by the
Information Commissioner
DECISION
For the reasons set out below the Tribunal allows the appeal in part and makes the following
substitute decision
© CROWN COPYRIGHT 2023
Appeal Number: EA/2020/0317
SUBSTITUTE DECISION NOTICE
1 By the date that is three months after the date of this decision (the “Relevant Date”),
Experian must set up a system that enables it to provide all data subjects whose
personal data is obtained by Experian from one or more of the Open Electoral
Register, the Registry Trust Limited or Companies House (those data subjects being
the “Relevant Data Subjects, and those sources together being the "Open Sources”)
with a privacy notice (a “Relevant Notice”).
2 The Relevant Notice must: (i) inform the Relevant Data Subject that their personal
data has been obtained by Experian and is being processed by it for direct marketing
purposes, and (ii) otherwise comply with Article 14 of the UK GDPR. For the
avoidance of doubt:
(a) A Relevant Notice may be provided to the Relevant Data Subject by Experian
either (i) through any form of direct communication by Experian with the
Relevant Data Subject (e.g. through the post or, if Experian has the relevant
contact details for the Relevant Data Subject, via email or text message) or (ii)
through the medium of the notifications given to Relevant Data Subjects by the
Open Sources.
(b) No Relevant Notice is required to be sent where: (i) Experian has obtained
personal data about the Relevant Data Subject from its CRA business, its
consumer services business or from third party commercial suppliers, or (ii)
Experian’s processing of the personal data of the data subject is confined to the
retention or sale of the Open Electoral Register, or (iii) Experian’s processing of
the personal data of the data subject relates solely to the obtaining and use of
directory enquiry databases such as BT OSIS or suppression databases like the
TPS, or (iv) Experian ceases to process personal data about the data subject for
direct marketing purposes at any time prior to the point at which, pursuant to
this Substitute Enforcement Notice, a Relevant Notice would otherwise be
required to be sent to the data subject.
3 Subject to paragraph 2 above, the Relevant Notices must be sent to the Relevant Data
Subjects as follows:
(a) Within twelve months of the Relevant Date, Experian must provide a Relevant
Notice to all data subjects whom it identified as being Relevant Data Subjects as
at the Relevant Date.
(b) In circumstances where Experian obtains personal data from the Open Sources
in respect of data subjects who: (i) were not identified by Experian as having
been Relevant Data Subjects as at the Relevant Date, but (ii) are identified by
Experian as being new Relevant Data Subjects, Experian must provide those
individuals with a Relevant Notice.
4 Nothing in this Enforcement Notice requires Experian to provide more than one
Relevant Notice to a Relevant Data Subject.
5 No financial penalty is imposed.
2
Appeal Number: EA/2020/0317
REASONS
Preliminary matters
Definitions
attribute Actual information, or modelled information in Experian
database
CAIS Credit Account Information Sharing service - closed user group
database, forming part of the Experian CRA, used for sharing
credit account information between those entitled to access that
database.
ChannelView A database - principally used by Experian to link contact details
with existing name and address profiles in ConsumerView
CIP Consumer Information Portal – the website maintained by
Experian providing transparency information to data subjects
about Experian Marketing Services’ activities and as found at
https://www.experian.co.uk/cip
ConsumerView ConsumerView is a database which combines name and address
information with actual, derived and modelled information on
the demographic, socio-economic and behavioural
characteristics of individuals and households7
CRA Credit Reference Agency
CRAIN Credit Reference Agency Information Notice – most recent
considered was March 2020 EN para 25
DPA18 Data Protection Act 2018
ECS Experian Consumer Services
EDPB European Data Protection Board
EMS Experian Marketing Services (a business unit of Experian)
Experian Experian Limited, the appellant
FCA Financial Conduct Authority
GDPR General Data Protection Regulation, Regulation (EU) 2016/679
on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, as
enacted by the European Union
Information The respondent
Commissioner
3
Appeal Number: EA/2020/0317
LIAs Legitimate Interest Assessments
Mosaic A database which uses ConsumerView – as well as third party
datasets – to build segments illustrating demographic and
lifestyle attributes at postcode and household levels, hence non-
identifiable. If an attribute from Mosaic is appended to an
individual in ConsumerView, this attribute is then considered to
be personal data
NMR No Marketing Requests database of those who have opted out of
marketing communications used to pre-screen data provided to
third party clients to ensure that their data is not processed for
marketing purposes (beyond implementing their opt-out
decision)
Non-prospectable Data acquired from the CRA business and where Experian will
not share the name and address data with their clients for the
purposes of reaching potential new customers or prospects - see
further at [10] below
OER Open Electoral Register
propensities The likelihood of a characteristic in the form of a score - Added
to Experian database against individuals
segmentation Modelled information at a non-identifiable level, added to
individuals in Experian database
Chronology
25 May 2018 GDPR comes into force
17 April 2019 Preliminary Draft Enforcement Notice
20 April 2020 Revised draft Enforcement Notice
Introduction & Background
1. Experian is a well-known Credit Reference Agency (“CRA”). In that capacity it holds
and processes data relating to over 51 million people living in the United Kingdom,
effectively the whole of the adult population. What is less well known is that Experian
has within it a business unit, Experian Marketing Services (“EMS”), which processes
the data of around 51 million people in the UK to provide marketing services which it
sells to its third-party clients. It does so by combining their name and address
information, with a total of up to thirteen actual attributes. It then processes this data
and creates modelled information on the demographic, social, economic and
behavioural characteristics of these 51 million individuals on a predictive basis, the
4
Appeal Number: EA/2020/0317
profile for each person running to as many as 49 derived data points about individuals
and up to 370 modelled points about individuals, with each profile running to many
pages.
2. The enforcement notice relates to Experian’s processing of personal data for marketing
services for its offline, not online, marketing services.
3. The direct marketing services business is operated by EMS, which is a separate
business unit within Experian but is not a separate legal entity. For that reason, we
refer in this decision to Experian, not EMS, as it is the legal entity which is the
appellant. Broadly, Experian does not carry out marketing in its own name, but its data
processing furthers the direct marketing of third parties, that is, Experian’s customers.
4. For the purpose of the EMS business, Experian acquires the personal data of individual
data subjects from a variety of sources in broadly three strands. It obtains publicly
available information from sources such as the Open Electoral Roll (“OER”),
Companies House and the register of County Court Judgments. It also acquires data
from third parties such as Gardeners’ Club. It also acquires data from its CRA business.
It does not process the data from these three strands in the same way.
5. Experian processes the data to create three different products which are relevant to the
notice and the appeal: ConsumerView, ChannelView and Mosaic. There is, in addition
to those services, a credit pre-screening product that uses some elements of CRA data
only offered to members of Credit Account Information Sharing service (“CAIS”).
6. Broadly, Experian has no direct relationship with individuals whose data it processes
for the purpose of these products, except in a limited number of cases when
individuals contact Experian via the Experian website or where they have a direct
relationship with Experian via Experian Consumer Services (“ECS”).
7. ConsumerView contains entries at an individual level for some 51 million adults in the
United Kingdom, that number changing from time to time due to changes in the UK
adult population, as a result of deaths and people turning 18. ConsumerView
combines name and address information, with a total of up to thirteen actual
attributes. It then processes this data and creates modelled information on the
demographic, social, economic and behavioural characteristics of individuals and
households on a predictive basis. The actual information reflects known
characteristics of a given individual; the derived information reflects characteristics
that are calculated or ascertained from other data, the modelled information reflecting
predicted characteristics.
8. ChannelView’s database contains names, postal addresses, email addresses and
mobile phone numbers are predominantly provided to Experian by various third data
suppliers who between them collect data from data subjects via some 148 websites in
return for access to offers and discounts, price comparison services, the ability to
participate in surveys and so on. The total number of records will vary from time to
time, but it contains details of at least 24 million individuals.
5
Appeal Number: EA/2020/0317
9. Mosaic uses data from public and commercial sources in order to attribute households
into fifteen overarching groups, 66 household types and 155 person types. Some of
the information through which Mosaic is created is taken from the individual profiles
on ConsumerView but there are other non-personal data sources which read into that.
Mosaic codes are appended to the individual level profiles within ConsumerView.
CRA-Derived Data
10. Experian uses data derived from Experian’s CRA business in the following ways:
(1) to add names and addresses to ConsumerView (about 25.1 million individuals
are added to ConsumerView by this route);
(2) to ensure the accuracy of the 25.9 million prospectable records included in
ConsumerView;
(3) to match and link records from different sources;
(4) to build the derived and modelled attributes within ConsumerView.
In this context, “prospectable” means that a name and postal address will be shared
by EMS with customers who do not already have that name and address, to help those
customers reach new business and supporters. Others are non-prospectable which
means that the name and address data will not be shared in this way, but information
concerning them can be shared with customers who already have those individuals
name and address.
Experian treats the records obtained from the CRA as “non-prospectable”. With the
exception of the credit pre-screening product, the only data points derived from
Experian’s CRA business that are used by Experian are name, address and date of
birth. The CRA derived data is also used to offer a credit pre-screening product to
customers who were a member of the CAIS which operates to remove people from the
marketing lists through credit, products and circumstances where they would likely
be declined if they were to make an application for the product.
11. Experian does not see its business as data broking and has put in place contractual
restrictions preventing data from being resold, if it is sold, to a data broker. It also
maintains a red list of organisations that it will not work with including tobacco and
payday loan companies. It also maintains an amber list of organisations it will only
work with if specific internal controls are satisfied.
12. Experian has a created a “Consumer Information Portal” (“CIP”) on its own website
which sets out the ways in which Experian processes data. The Information
Commissioner does not accept that this is adequate.
The Enforcement Notice
13. In its notice the Information Commissioner notes [18] Experian’s assertion that its
processing takes a form of data analytics rather than marketing but that the purpose
6
Appeal Number: EA/2020/0317
of the data analytics business is to further the data marketing activities of third parties
and that the scale and scope of the process in question is on a very significant scale. It
notes two primary databases, ConsumerView and ChannelView, and how Experian
acquires personal data [21]. It notes [21] that Experian uses names and addresses from
CRA data to validate existing marketing records and for use in model attributes
relating to household composition, noting that even the use of CRA data for the
purposes of validating an individual’s name (in screening purposes), matching and
linking records, building models of groups of individuals and screening out people
with inappropriate credit history “may involve accessing credit reference data in
unexpected ways such as establishing individual’s current and most recent risk by
checking for recent credit repayments for that address”. It notes also that Experian
makes available and relies on the Credit Reference Agency Information Notice
(“CRAIN”), the general notice produced and used by credit reference agencies which
sets out the wide variety of sources used by Experian and the other CRAs to obtain
data about individuals and how the data may be used.
14. The Information Commissioner concluded [27] that Experian committed a number of
contraventions in five separate categories identified as A to E, but D to E relate to
matters where the Information Commissioner no longer considers enforcement action
is required.
Category A: Fair and Transparent Processing Article 5(1)(a)
15. The Information Commissioner considered that collation of a wide range of personal
data about a huge number of data subjects constitutes processing on a scale and for
detailed analytical purposes which few data subjects would expect and constituted
data profiling within the meaning of Article 4(4) GDPR. On that basis, the Information
Commissioner considers it is incumbent on Experian to ensure that it is as transparent
as possible about the data it is using; where it has been obtained from; and the ways
in which it is used. In the Information Commissioner’s view, data subjects are
precluded from being able to exercise the rights supported by the GDPR without clear
detailed and transparent information, provided in a way that a data subject can readily
understand. The Information Commissioner considers that the requirement of
transparency in Article 5(1)(a) goes beyond simple compliance with Article 14 and is
context dependent.
16. In the preliminary enforcement notice, the Information Commissioner set out
provisional findings that the CIP did not generally comply with the transparency
requirement, as it had not made EMS’ processing activities for marketing purposes
sufficiently clear, nor that credit data is processed in connection with direct marketing.
The Commissioner concluded that the data subject would have been unable to
understand the limited references to the sort of processing in the notices [31], the
previous notice being insufficiently precise and detailed; nor did they provide
examples of how data is processed to aid understanding.
17. Nor did the CIP detail the rights available to data subjects, for example the rights of
rectification and restriction of processing pursuant to Articles 16 and 18 GDPR, or the
7
Appeal Number: EA/2020/0317
retention period from which personal data held for the marketing process will be
processed. The Information Commissioner considered also that, where information or
attributes are attached to an individual’s profile, that is processing of personal data
and is in the form of profiling in the meaning of Article 4(4) GDPR and this was not
transparently explained [33].
18. The Information Commissioner noted [35] that Experian had changed the CIP and
undertaken other work to improve transparency. She reviewed the CIP as at October
2019 [36], has continued to review it and the user research undertaken by Experian in
December 2019 but [37] considered that even in its most recent version, (that is, at the
date of decision) the CIP still fails to achieve the necessary transparency, in particular
as:
(a) The CIP still fails to set out clearly in one place and at the forefront of the privacy
information the attributes (actual and modelled) which may be processed about
an individual.
(b) Information likely to surprise individuals e.g., the fact that data is used to trace
individuals for marketing is held in the third or fourth layer of the CIP contrary
to the guidance from the Article 29 working party that such information should
always be at the forefront of the previous information.
(c) The language of the CIP emphasises the benefits of data broking without giving
any real explanation of the potential drawback or outcomes individuals may find
undesirable, there being a lack of balance and an apparent intention to persuade
an audience as to the benefits, such as characterising licencing for financial gain
as “sharing”.
(d) Individuals are still likely to be unclear as to the potential outcomes of the
processes for them in real world terms, possibly including the fact that their data
is being shared with political parties.
(e) The use of industry language such as “insight”.
(f) Examples of processing from the point of collection to some real use cases were
absent in some sections, making it harder for individuals to visualise the complex
processing of their personal data; although not specifically required by Article 13
or 14, it was considered they were vital to ensuring wider transparency
obligations.
(g) The Information Commissioner also considered that (as is set out in the CRAIN),
the processing of individuals’ personal data connected to their actual or profiled
credit information to screen them out for receipt of direct marketing was
processing for direct marketing purposes, as is the decision to screen in a data
subject on the basis of their financial information and that, although the version
of CRAIN published in March 2020 addresses some of these deficiencies,
problems still arose. (See paragraphs 40 and 41).
8
Appeal Number: EA/2020/0317
(h) The Information Commissioner considered that this type of processing -
screening out - would not be expected by the data subject and is unfair; the
processing of personal data collected specifically for the question of maintenance
of credit reference files for screening or any other direct marketing should cease
unless and until transparently explained and the individuals questioned have
consented to the processing.
(i) It considered also that the processing is unlikely to be expected by a data subject
and is of a higher level of intrusion; and, individuals have no choice but that their
data is shared with Experian. The Information Commissioner considered that it
was not appropriate for credit reference data to be obtained by Experian for direct
marketing purposes without the consent of the individuals concerned, stating:
“The Commissioner expects that Experian would obtain consent for their
credit reference information to be used for direct marketing in this manner:
such consent could either be obtained by Experian directly from the
individual or by the lender on Experian’s behalf, clearly and separately in
the collection of data to be shared for credit referencing purposes.”
(j) It is suggested at paragraph 42 of the EN that one solution for Experian may be
to obtain elements of public information, eligible personal data for both credit
referencing purposes and additionally for their direct marketing purposes, which
could involve severing that part from the credit referencing business.
(k) The Information Commissioner notes [43] that Experian has contravened Article
14 GDPR in failing to notify data subjects that their personal data has been
acquired by Experian and has been processed for direct marketing purposes. It
is noted also that, where they acquire the personal data of a data subject from a
third party, Experian does not provide Article 14 privacy information to the data
subject directly but proceeds on the basis that the data subject already had been
given the information set out in Article 14, such as Article 14(5)(a), which (in
Experian’s’ view) dispenses with the requirement for Experian itself to provide
the information.
(l) The Information Commissioner did not accept that Article 14(5)(a) exempted
Experian from its own Article 14 obligations; while a data subject is reasonably
likely to expect that their credit data would be provided to a credit reference
agency for credit referencing purposes, they are not likely to expect that the data
would be used by the credit reference agency for their direct marketing purposes.
This would occur only if they reviewed both third party suppliers’ privacy policy
and the CRAIN and CIP of Experian, which do not draw attention to the
provision of data to Experian and the use of that data for direct marketing
purposes, which is inconsistent with the Information Commissioner’s guidance
on “the right to be informed” and the guidance of the EDPB, with reference to
how layered privacy notices are used. The Information Commissioner did not
accept Experian’s representation that having to rely on direct notification was a
disproportionate effort as, either the data subject already has the information
9
Appeal Number: EA/2020/0317
required for Article 14 and hence falls within Article 14(5)(a) or did not have that
information and hence falls outside Article 14(5)(a). It is stated:
“The Commissioner does not accept that any of the data subjects who are not direct
customers of Experian have the necessary information to satisfy Article 14(5)(a):
still less does she accept, as asserted by Experian, that all of the individuals whose
data are provided to Experian, through third parties of the necessary information.
Article 14(5)(a) cannot therefore apply.”
19. The Information Commissioner notes also that where personal data has been acquired
from publicly available sources (via third parties or otherwise), Experian does not
ensure Article 14 compliant information is sent to the affected data subjects. Experian
asserted that it would be disproportionate for it to notify those data subjects, thus it
relies on Article 14(5)(b) in respect of the data subjects on the basis of disproportionate
costs. The Information Commissioner did not accept that Article 14(5)(b) is satisfied
[48] nor did she accept the suggestion from Experian that its processing is not intrusive
and likely to be expected. She accepted that any direct notification exercise would be
costly but did not accept that it would be ignored by data subjects. She took the view
that direct notification is not disproportionate, and thus Experian cannot rely on
Article 14(5)(b).
20. The Information Commissioner concluded that the extensive processing carried out by
Experian, coupled with the largely invisible nature of that process, (in particular the
profiling of data subjects by which Experian compiles public and non-public data to
create marketing profiles of individuals [50]) was intrusive. Although not the most
intrusive type of processing, it nonetheless involved the compilation of a wide range
of data from public and private sources so as to build a profile of some 49.8 million 1
data subjects, few of whom would expect such processing on a mass scale.
21. The Information Commissioner’s case is that Article 14 imposes an important
obligation given the need for transparency in respect of data subjects who would not
otherwise be aware that the controller is processing their data and that exceptions to
the principle should be narrowly construed.
22. The Information Commissioner rejects Experian’s reliance on its rights under Article
16 of the European Charter of Fundamental Rights, which relates to the fundamental
right to conduct business as the action has been taken to secure the fundamental
charter of rights under Article 7 previously and Article 8 personal data. [53].
23. The Information Commissioner considered also that notification in relation to the
processing of data with reference to the personal data collected from the Open
Electoral Register, is nonetheless disproportionate with reference to Article 14(5)(b).
Category C: Lawful Processing: Article 5(1)(a) and Article 6(1)
1 This is the figure given in the Enforcement notice. As the parties accept, the actual number of data subjects
fluctuates as people are added once they turn 18, and others are removed on death.
10
Appeal Number: EA/2020/0317
24. The Information Commissioner considered that Experian had contravened both of
these articles. That was because Experian processed all of the personal data held for
direct marketing purposes on the basis of its legitimate interest [56], but the
information provided by third party suppliers was provided on the basis that those
third parties data subjects’ data was obtained by consent. The Information
Commissioner was not satisfied that, in circumstances where a very large amount of
personal data is being processed in highly targeted ways and where there are
significant issues of non-transparency, Experian had correctly or properly concluded
there is a lawful basis for processing the personal data. The Information
Commissioner rejected Experian’s assertion that the processing for profiling is not
intrusive of privacy, considering that this is unjustified and noting that European data
protection authorities have, for example, been clear for many years that profiling
activities are likely to present a significant intrusion into the privacy of the data subject
and the controller’s interest will be overridden as a result. The Information
Commissioner’s case is that little weight can be attached to the supposed benefit of the
data subject receiving direct marketing communications more appropriate to them and
this is a consequence of processing and profiling to which they have not consented.
The Information Commissioner considered that it was unlikely that a controller would
be able to apply legitimate interests for intrusive profiling for direct marketing
purposes [58]. It is of the view that where profiling for direct marketing purposes is
not intrusive, the legitimate interest may still be used. Intrusiveness is necessarily
qualitative in contextual assessment based on various factors.
25. With regard to personal data obtained from third party suppliers, the Information
Commissioner took the view that Experian could not further process the data collected
on the lawful basis of consent on the basis of its own legitimate interests and thus the
appropriate lawful basis for any subsequent processing or direct marketing would also
need to be consent. Switching to legitimate interests sharing or otherwise onward
processing of data after that data was collected on the basis of consent would mean the
original consent was no longer specific or informed; it would also misrepresent the
data subject’s degree of control and the nature of relationship with the individual.
26. The Information Commissioner considered that the new legitimate interest
assessments produced in February 2020 continued to reflect the erroneous view
concerning the limited intrusiveness of direct marketing processing and place a low
value on the benefits and necessity of transparency, in some cases relying on the
ongoing use of legitimate interests as a lawful basis despite collection of that data being
based on consent. Thus, the legitimate interest assessments were neither properly nor
lawfully balanced.
27. Turning to the privacy notices provided by the third-party data suppliers who supply
Experian, it was concluded that where those notices simply linked to Experian’s own
privacy notice, this was insufficient to comply with Article 14 GDPR obligations. given
the extensive intrusive nature of the processing. She noted Experian had conducted an
audit of the privacy notices of its stated suppliers and had reduced their numbers as a
result. The Information Commissioner carried out a further review of sample supplier
sites, “Gardeners club” for Web-Clubs Digital Limited and My Offers Limited and
11
Appeal Number: EA/2020/0317
found that, whilst the current collection model was improved [65], it was not
sufficiently clear, although they appeared to state that sharing of their data with
marketing service providers such as Experian can be carried out on the basis of
legitimate interests. It is considered that more clarity about the degree of control is
needed to be given, leading to the finding [67] that Experian must ensure that the data
obtained from all of their third-party suppliers is either compliant or else not
processed.
28. Although noting that Experian does not in general process special category data,
certain of the categorisations used in Mosaic could amount to special category data
when appended to identifiable data subjects. These categories were removed by
Experian between the Information Commissioner’s audit and the service of the
Enforcement Notice.
29. The Information Commissioner considered that the contraventions identified were
significant and required enforcement action given the large number of data subjects
affected, the nature of the processing’s significance in privacy terms, including
elements of profiling, and the collation of a wide range of personal data from different
sources. There was a significant element of Experian’s processing of personal data,
which was invisible to the data subject and that to some extent the scale and scope of
the business operating role appears dependent on the processing being invisible in the
sense that it relies on data subjects not being likely to exercise their rights to object to
the processing. It is asserted that there is little of public interest in Experian’s
processing beyond their same commercial interests and the commercial interests of its
third-party clients.
30. The Information Commissioner considered, as required to do so under Section 150(2)
DPA, whether any contravention has caused or is likely to cause any person damage
or distress. She considered that, for at least some data sources, distress is likely in the
present context and did not accept the assertion that the processing is essentially
anodyne. She has stated that mass processing of personal data for marketing purposes
is likely to lead to a significant number of data subjects receiving marketing they did
not expect to receive and for some data subjects this is likely to cause distress, although
we note why that is so is less clear. It is noted also that a significant majority of the
public consider the sale of personal data and the use of personal data to profile in the
offline marketing context to be unacceptable. The Information Commissioner also
had regard to the desirability of promoting economic growth [80] and the potential
impact the notice might have on Experian’s contribution to that, but considered that
the steps required, even if they involved the cost of the business, were necessary and
proportionate to ensure fair and lawful processing of large amounts of personal data.
The Information Commissioner also had regard to her regulatory action policy
considering that the contraventions found in the notice show Experian are failing to
meet information rights obligations of a very serious and ongoing nature [84]. She did
not accept the effect of the enforcement notice would be the extreme consequences
asserted by Experian but took the view that if Experian wished to continue to process
personal data in the same way as it had been doing, the requirements imposed by the
12
Appeal Number: EA/2020/0317
Notice will come with a financial cost to it; that was the cost of lawful processing, and
results from Experian’s own choices as to how it conducts its business. [87].
Experian’s Grounds of Appeal
31. The grounds of appeal are detailed and lengthy. In summary, it is averred that the law
has been applied incorrectly and/or that flawed conclusions have been reached on the
facts. It is averred also that the requirements of the notice are disproportionate and
unfair and that the notice should be set aside in its entirety. Experian did not accept
the Information Commissioner’s conclusions in respect of categories D and E although
they were not the subject of enforcement.
32. The overarching ground of challenge is that the notice is an attempt by the Information
Commissioner to impose its subjective preferences as if they were legal requirements
under the GDPR, and that those subjective preferences are based on a
mischaracterisation of Experian’s business and its impact on individuals’ privacy. The
result, it is said, would be that Experian would be compelled to adopt an unworkable,
purely consent based, model for offline marketing services and this would, if complied
with, force Experian to shut down its offline marketing services business.
33. In ground 1, it is averred that effective and efficient marketing is fundamental to the
achievement of an efficient and effective marketing consumer economy; that the
offline marketing services offered by Experian strongly contribute to the achievement
of that and that any cessation of this activity would be likely to have a serious adverse
effect on the operation of a wide variety of individual commercial actors seeking to
grow their businesses and flourish and to effective and efficient marketing to
individuals; and, Experian’s activities serve the interests of the data subjects who are
affected by their processing, not least by ensuring that they receive marketing
materials which are more likely to be relevant and therefore of interest to them,
limiting the scope for them to receive irrelevant marketing communications, and in
helping to deliver lower prices due to more efficient marketing and competition.
34. In ground 2, it is averred that the Information Commissioner repeatedly asserted that
Experian’s processing activities would not be expected by the data subjects and that
these activities would be likely to cause distress. It is averred [11] that this is not only
unevidenced but also wholly incorrect as the data processing activities have very
limited implications for the previous rights of individuals, as Experian uses data from
public sources to build statistical models from which attributes could be inferred. It
does not process the actual data relating to individuals’ behaviour nor does it track
their internet activity or locations.
35. Ground 3: the Information Commissioner has made wrong assumptions as to the
nature of Experian’s business model and it is not, contrary to what the Information
Commissioner has stated, designed to avoid the requirements of the GDPR but rather
the Information Commissioner has failed to apply the relevant GDPR requirements in
the context dependent, fair, proportionate and otherwise lawful manner required. It
is averred that the Information Commissioner erred in concluding that Experian
conducted its business to ensure that its processing activities remain invisible [15] for
13
Appeal Number: EA/2020/0317
which there is no evidence. It is asserted that Experian’s business model does not
depend on the processing being invisible and, the Information Commissioner’s finding
on this issue is perverse.
36. Ground 4: It is asserted that the Information Commissioner’s approach is
disproportionate and out of step with the legal principles set out in Article 14 and
recital 4 to the GDPR as well as with public policy given the nature of the economic
harm that is likely to occur as a result of the enforcement notice.
37. It is also averred [Ground 5] that the result of the Information Commissioner’s
conclusions would be perverse as the privacy notice would be rendered less and not
more meaningful as it would then lack effective, user friendly layering and structuring.
Experian and its clients would be hampered in an effort to ensure that financially
vulnerable people are not unduly exposed to marketing materials which may draw
them more deeply into debt and Experian would need to send communications to data
subjects which would be likely to be viewed by them as unnecessary and irritating if
the recipients bothered to read them at all, as well as being environmentally unsound.
38. In addition, turning to the enforcement requirements, it is averred [22] that the
Information Commissioner’s findings with regard to the transparency of the CIP are
not maintainable, and amount to a subjective criticism reflecting the Information
Commissioner’s preferences but failing to establish any contravention; that is the
Commissioner fails to establish that the CIP as it currently stands fell short of what
Article 5(1)(a) GDPR requires, the Information Commissioner applying a counsel of
perfection rather than assessing adequacy. It is averred also [25] that requirement A1
is untenable. The information to be adduced would result in so much “frontloading”
as to likely to confuse the data subject. It is averred that requirements A1(b) and (c)
are also untenably vague and requirement A1(d) is unjustifiably granular.
Requirement A2: Consent for the use of Credit Reference Agency data
39. It is averred [30] the Information Commissioner’s analysis is wrong in fact as Experian
explains its processing activities through the CRAIN in significant detail, the terms of
which are clear and meet the requirements of Article 5(1)(a). It is asserted also [30(ii)]
that the conclusion that Experian could only lawfully process CRA data where consent
had been obtained from data services is wrong as, given the nature and circumstances
of the processing of the CRA data, that processing falls within the scope of legitimate
interests condition provided for in Article 6(1)(f). The Information Commissioner has
fallen into error because of its flawed conclusions as to how CRA data is used. There
are only four use cases to be considered.
40. Three of these cases only result in the processing of name, address and date of birth
for validation matching and linking and that these cases are justified under legitimate
interest as: they further legitimate interest by enhancing the accuracy and effectiveness
of relevant marketing activities; they are not meaningfully intrusive or prejudicial to
the data subjects; and data subjects who have been provided with an adequate privacy
notice through the CRAIN then have the option of opting out of their data being used
in these ways, thereby exercising rights under Article 21 GDPR.
14
Appeal Number: EA/2020/0317
41. It is averred [30(v)] that the Information Commissioner improperly focuses on the
fourth use case, that is the use of limited data relating to individual’s credit activity for
the process of determining whether they would be screened out of receiving marketing
which does not result in additional marketing activities but, on the contrary, limits
marketing activities to ensure that marketing is not inappropriately sent to financially
vulnerable people who may, as a result of those communications, be encouraged to
fall further into debt. This, it is said, is beneficial, avoiding wasteful marketing
activities and perpetuates an important interest in safeguarding financially vulnerable
individuals and their families against undue and harmful indebtedness. It is averred
it is not a higher level of intrusion and is not unfair given its protective effects.
42. It is averred that the Information Commissioner’s conclusion that the consent must be
obtained regarding the prospect of the processing of CRA data is, in itself, inherently
problematic particularly in view of the GDPR requirement that consent be freely given,
which could not be so in this case due to perceived imbalances of power between the
consumers and lenders.
Requirement C3: Data Sourced on a Consent Basis
43. It is averred that the Information Commissioner has erred in concluding that
Experian’s own processing of data obtained from third parties must in itself be on a
consent basis in order to be lawful under Article 6 GDPR. It is averred that Experian’s
sources of personal data do in fact obtain data on the basis of the Legitimate Interests
condition [33] and to that extent requirement C3 is misconceived. It is further averred
that in any event, the extent to which some of Experian’s sources did rely on consent
in the past, and the data subjects provided the supplier with GDPR compliant consent
to provide the data to Experian, once Experian received their data in accordance with
the consent it continued to process their data on the basis that it was processing the
data that the Legitimate Interests condition applies to, which is perfectly lawful. It is
submitted that to require Experian to obtain the consent of these data subjects is
excessive and goes beyond any requirement opposed under GDPR. It is averred
[35(iii)] there is nothing in the GDPR which suggests or expressly implied that, where
a third-party supplier provides data to a person pursuant to consent, the recipient may
itself only process that data pursuant to consent whether in the context of marketing
activities or at all.
44. It is averred that the requirements B4 and B5 by which the Information Commissioner
requires Experian to send privacy notices directly to all data subjects whose data was
not obtained by Experian directly from those data subjects, or in the alternative, cease
processing their data, is misconceived and rests on a flawed analysis of the scope of
Article 14. It is averred also, with respect to Article 14(5)(a) that more than 90% of the
data subjects whose data is processed by Experian are provided by lenders of third-
party vendors with links to the CRAIN and/or Experian’s CIP, each of these
constituting a sufficient of privacy notice in its own right, which accords with the letter
and spirit of EDPB transparency guidelines. Further it is averred that whilst Article
14(5)(a) might not have been engaged in respect of the residual less than 10% data
subjects affected by its processing, reliance is placed on Article 14(5)(b) averring that
15
Appeal Number: EA/2020/0317
any direct notification will be disproportionate given that their data is derived
exclusively from public sources, namely the edited electoral role and county court
judgments [43]. In the circumstances they can have no reasonable expectation of
privacy in the processing of their data by Experian given it is publicly available. And,
that the proposed direct notification exercise is wholly disproportionate.
45. It is averred [49] that the criticisms of the legitimate interest assessment are ill-founded
and are based on incorrect conclusions about alleged deficiencies in the transparency
measures and the allegedly intrusive nature of the processing activities. Therefore,
there is no basis for them. It is averred also that the requirements with regard to
privacy notices by the third-party data suppliers are equally unclear, vague, and
subjective and it is averred that there is no contravention in any event of Article 5(1)
GDPR.
46. It is averred also that the Information Commissioner’s decision to issue an enforcement
notice was flawed as it is based on the conclusion that any breaches that exist are
instantly sufficiently serious to justify the enforcement notice. It is said that this
assessment is unbalanced and unfair.
Information Commissioner’s Response
47. The Information Commissioner considers the scale of the processing to be highly
significant [12], Experian’s offline marketing business being premised on it creating
and maintaining mass databases containing entries for almost every adult in the UK
and then effectively profiling each individual to the extent of estimating their likely
marketing susceptibilities or assisting others to do so. It is averred also that very few
data subjects understand that Experian has created such databases from data which
populates some of the wide range of publicly available data sources and then profiles
the data subject for marketing purposes which, they consider, is “invisible processing”.
It is averred that it is especially important that such large scale processing should be
properly transparent [15] as there is a risk that when such quantities of data are
processed, including by modelling attributes attributed to large numbers of the data
subjects, personal data is processed in a manner which is not understood by them, with
which they do not agree, and which is of concern to them. That lack of transparency
has the effect that the array of their rights afforded by the GDPR are rendered less
effective if not wholly ineffective.
48. The reasoning behind the requirements is set out and the overarching grounds of
appeal are challenged. Paragraph [37(1)] states that the Commissioner does not require
the offline marketing services to be processed entirely on the basis of consent, but
requires the use of any personal data derived from Experian's CRA activities for any
direct marketing purposes, to be based on consent. It is not accepted that compliance
with the notice would require Experian to shut down its offline marketing business. It
is denied that the Information Commissioner sees Experian’s offline marketing
business to be socially undesirable, bordering on illegitimate and the Information
Commissioner rejects the business being justified on environmental grounds. It is
16
Appeal Number: EA/2020/0317
averred also that the assertion that regulatory action against Experian would be likely
to cause widespread economic damage is wrong.
49. It is averred that, following DH v Information Commissioner and Bolton Council
[2016] UKUT 139 (AAC), in considering fairness, regard should be had amongst other
matters to the reasonable expectations of the data subject and that such persons would
not reasonably expect to find that Experian has built a database of publicly available
data about them along with almost every other person whose data is held in the UK
and is processing their data by ascribing to them attributes that they may or may not
have. The Information Commissioner does not consider that the data subject would
reasonably expect Experian in certain respects to use data that it obtained as a CRA to
further inform such processing and it is averred that it does process data about
individual’s credit i.e., their actual behaviour in order to inform its direct marketing
processing.
50. It is averred that the Information Commissioner has not assumed the processing is
secretive, but has found that the processing does not comply with the transparency
obligations in the GDPR, relying on the common-sense point that the less awareness
there is about Experian’s processing the less likely that it is that data subjects will
exercise their rights to object to the processing or seek erasure. It is averred also that
compliance is not disproportionate, nor would there be perverse results. With regard
to the requirements, it is averred that the Information Commissioner is not posing too
high a standard and that Experian’s case fails to recognise that the principal
requirement of transparency is a high level obligation and it is the necessary role of
the national supervisory authority under the scheme of the GDPR to form a view. In
all the circumstances, having regard to the purpose of the principle in question as to
whether or not controls meet that standard, any other approach would render the
principles unenforceable. It is averred that the notice does not require excessive detail
which would diminish transparency nor is it accepted that what is required is vague.
51. With regard to the manner in which Experian uses data derived from its CRA
activities, it is averred that data subjects would not reasonably expect Experian to take
the data processed for credit reference purposes and then use it to verify and cross-
check its data sets for direct marketing purposes, data subjects having no realistic
choice in their personal data being processed by CRAs. It is fundamentally unfair for
a CRA to then use their data for an entirely different and unrelated area of business
and that this is unfair processing contrary to Articles 5(1)(a) and 6(4). It is averred that
Article 6(1)(f) cannot provide a lawful basis for such processing, it is fundamentally
unfair to the data subject in question and that the processing in this case is not
“relatively innocuous”. It is not advantageous for the data subject and the processing
takes advantage of Experian’s position as a CRA and is privacy intrusive processing.
It is averred also that even where consent is relied upon the context means that
transparency will continue to be particularly important.
52. It is reiterated that when data is provided on the basis of consent to one controller and
that data is then processed by a different controller on a different basis (legitimate
interest) then the initial basis of consent is not sufficiently clear. It is averred also that
17
Appeal Number: EA/2020/0317
the right to object to direct marketing processing Article 21(2) is now put right, which
Experian’s processing circumvents to the detriment of data subjects and its commercial
advantage.
53. With regard to requirements B4 to B5 it is averred that the Information Commissioner
is seeking to enforce the obligation in Article 14 but Experian is seeking to avoid it. It
is averred also that Experian’s reliance on Articles 14(5)(a) and 14(5)(b) is misplaced
and that the proposed interpretation of Article 14(5)(b) is incorrect [74]. It is averred
that the processing in this case is not relatively trivial given the extensive nature of the
data collection, modelling and profiling.
54. It is denied that the Information Commissioner’s approach to the legitimate interests
assessment is incorrect. The Information Commissioner’s concern being that with
regard to Article 6(1)(f), Experian’s approach is not properly conducted, in that they
have failed to have regard to relevant considerations namely the intrusive nature of its
profiling, processing and the implications for its transparency stance. It is averred also
with regard to its suppliers’ privacy information that their requirements are vague or
unclear and that in neither current nor historic data supply cases has the personal data
processed by Experian being collected and then supplied compliantly with GDPR; the
Information Commissioner concluded therefore that Experian must cease processing
their data to ensure its suppliers are compliant going forward.
55. Finally, it is averred that the Information Commissioner was entitled to issue the notice
and Experian’s complaints in that regard are misplaced.
56. Experian replied to the response refuting the points made and asserting again that the
treatment of Experian by the Information Commissioner has been unfair and negative.
It is averred also [6, 7] that the Information Commissioner’s approach to the processing
of CRA data is inconsistent with the relevant regulatory requirements, that the
processing with regard to those who are financially vulnerable reinforced the public
interest importance in sharing data for the purposes of protecting the financially
vulnerable. It is averred also that the Information Commissioner continues to
overstate the intrusiveness of Experian’s activities and undervalue the transparency it
provides and it is the Information Commissioner’s flawed assessment of those pivotal
matters that are wrongly used to justify the conclusion that data subjects would not
reasonably expect Experian to process the data the way it does. It averred also that
they are not secretive or avoidant.
The Hearing
57. The panel heard evidence over several days. It heard evidence from Ms Shearman, Mr
Bendon and Mr Cresswell, Mr Grieves and Mr Parker on behalf of the appellant. We
also heard evidence from Mr Hulme and Mr Reynolds for the respondent.
58. In addition to this, we had extensive bundles running to several thousand pages,
supplemented by skeleton arguments and closing submissions which in themselves
ran to several hundred pages.
18
Appeal Number: EA/2020/0317
59. We are grateful to the parties for arranging to have a contemporaneous transcript
taken and provided to us; and to which we have been able to make extensive reference
in preparing our decision.
The Appellant’s Oral Evidence
Ms Shearman
60. Ms Shearman’s evidence is as a senior product manager at Experian who has been a
part of Experian for the past fifteen years, managing various EMS products including
ConsumerView and Mosaic. Her evidence set out the Experian products, that is
ConsumerView, Mosaic and ChannelView. She explained that the client base consists
of 1635 organisations through a range of sectors, Mr Grieves’ evidence being that 9.5%
of which are from the voluntary or public sector. The clients include retail, travel,
financial services, telecommunications, charities as well as political organisations
(comprising a small number of established political parties) and the public sector.
Retail is the largest sector.
61. Ms Shearman explained that the information within ConsumerView was collated at
three levels: individual level, household level and postcode level and that the
information held can be actual, derived or modelled. There are up to thirteen actual
data points, modelled data points and derived information that reflects characteristics
calculated or ascertained from other data, for example from their date of birth.
Modelled information reflects characteristics that a given individual, household or
postcode is predicted to possess based on Experian’s statistical modelling but is not
actually known to possess. These are predicted by algorithms based on a variety of
data sources (personal and non personal).
62. Ms Shearman explained the meaning of terms used by Experian including: attributes
or propensities and segmentations. When used by Experian those phrases have a
particular meaning: “attributes” refers to any piece of information relating to
individual, households or postcodes and may be actual, derived or modelled. For
example,
(a) Actual: whether they are a company director.
(b) Propensities are a modelled attribute where relevant information is expressed
with a number, representing how likely an individual living in that postcode is
to exhibit particular characteristic, for example whether they have a pet or own a
car.
(c) Segmentation: Groups together households with shared characteristics across a
number of attributes and propensities, for example segmentation may indicate
that households in a particular council area may be more likely to have a garden,
shop online and have more than one car.
63. Ms Shearman explained that Experian draws a distinction between “prospectable” and
“non-prospectable” data. If the individual’s record is prospectable this means
19
Appeal Number: EA/2020/0317
Experian may share their name and postal address with its clients to help those clients
reach new customers. If the individual’s record is non-prospectable, then Experian will
not share their name and postal information. Whether or not an individual’s record
and ConsumerView is prospectable depends on where Experian obtained the data
from. If the data is from the open electoral register or from various third-party
suppliers the records will be marked as prospectable. If the data is not obtained from
those services, then the data subject’s record will be marked as non-prospectable. That
means that where the name and information held on ConsumerView is data sourced
solely from Experian’s CRA the records would be marked non-prospectable. The data
obtained from CRA will be marked as non-prospectable.
64. Ms Shearman stated that Experian’s CRA business is entirely separate from EMS but
the data held is particularly important on account of its accuracy and
comprehensiveness but that the names and addresses sourced from the CRA business
never formed part of the prospectable data set and nor does EMS or its clients use
financial data derived from the Experian CRA business to target people with
marketing communications.
65. Ms Shearman explained also that in addition to the electoral register and third-party
data suppliers and its own credit reference files, Experian also uses Companies House
data and Registry Trust data (covering County Court judgments) to compile the
ConsumerView database. It also uses public sources of non-personal data such as the
Census, Land Registry and so on, none of this data being linked at source to
identifiable individuals. They also refer to commercial data sources such as
Rightmove, the Nationwide House Price Index and the results of pseudonymised
surveys covering representative samples of the UK population conducted by the likes
of YouGov from which broader trends and data can be extrapolated.
66. Ms Shearman explained that in ConsumerView they do not use special category
information, financial information derived from the CRA business or personal data
derived from real time data processing such as actual behaviour.
67. Ms Shearman explained that the ConsumerView database is built on a number of
steps:
(1) The first step is to produce a consolidated list of UK adults together with their
addresses.
(2) Appending actual attributes.
(3) Adding derived and modelled data which constitutes the vast majority of the
information contained in ConsumerView.
68. She explained that the database is rebuilt every calendar month in order to ensure it
remains up-to-date and remove the data of anyone who has opted out since the last
build. In approaching the second step, appending actual information, Experian first
does a matching and linking process, it may sometimes do this using CRA derived
name, address and date of birth data to give it a greater confidence than it would have
20
Appeal Number: EA/2020/0317
otherwise, to check that the records are correct. This helps identify cases where an
individual appears multiple times, albeit with slightly different details such as
“Jonathan Smith, Jon Smith and J Smith”.
69. At the third step, modelled information is modelled by first creating an annual update
file.
70. Ms Shearman explained that the model attributes and propensities are predictions,
and they are not 100% accurate.
71. Ms Shearman explained that Experian’s clients use ConsumerView for a wide range
of purposes: to plan and allocate resources and tailor offerings to maximise their
appeal and run a more effective marketing communication campaign. This may
include a proposal to open a new shop and to focus mailing campaigns on those most
likely to be interested in the relevant products. Experian also offers services drawing
on the mail preference service to enable organisations to avoid sending
communications to people where they have indicated that they do not want to receive
them and by enabling clients who are running direct mail advertising to suppress the
sending of information to people who have changed address or died, as well as
preventing the sending multiple communications as a result of persons appearing
several times and under different names and at multiple addresses. It is also used to
remove people from marketing lists for the reasons where it would not be appropriate
to send them specific communications, for example removing people from marketing
lists for a baby related product where they have signed up to the baby MPS service for
bereaved parents. This, it is submitted, makes the marketing more effective.
72. Ms Shearman explained that what the Experian client receives depends on the scope
of their contract. In some cases, it will simply be a list of names, and addresses of
prospective customers who fit certain criteria and that is all the data supplied, or it
may send extracts of the database, which will depend on the attributes, propensities
and segmentations as well as the groups in the population covered by its clients, but
the extracts will only ever contain a name and address for prospectable records.
Names and addresses would be replaced with irreversible hash codes in the case of
non-prospectable records or, Experian clients might send a list of names and addresses
which they already hold, requesting that Experian appends attributes and/or
propensities from ConsumerView.
73. Ms Shearman explained that Mosaic is different from ConsumerView and
ChannelView in that the data processed to create the Mosaic codes is all held at
household and postcode level and the processes utilised to establish the different
Mosaic group and type codes do not link back to individuals. Mosaic splits the UK
population into fifteen high level groups and 66 more granular types given their likely
characteristics. This is done by use of information from a range of sources including
the attributes, census data and other non-personal statistical data. Experian extracts
data from ConsumerView and third-party data in order to create rule sets for
households within the postcode and then runs further rules to create Mosaic codes
relating to specific groups and types that can then be appended to individual and
21
Appeal Number: EA/2020/0317
household data types held in ConsumerView. Mosaic rule sets are not sold to clients
as standalone products, they provide benefit to an organisation by helping them better
to understand their target audience.
74. Ms Shearman explained that Experian only uses CRA derived data for the purposes of
validation, matching and linking, modelling and credit pre-screening. For the
purposes of modelling, it uses a number of data points derived from CRA data, name,
address, date of birth, which informed model attributes service a number of adults,
household, composition and length of residence, the marital status and age. Mosaic
uses some of these ConsumerView attributes in the creation of the anonymised non-
personalised Mosaic models. She said that the CRAIN informs individuals that the
CRA data may be used for modelling purposes to:
“help build insight using profiling techniques which will be used by
organisations to help them identify people that they want to communicate with
or about particular products and services […] can help give organisations insight
into the likely characteristics of the UK population at an individual, household
and postcode level. Credit reference data also helps credit reference agencies to
validate the insight being created.”
She explained that credit pre-screening is only used for the prevention of over
commitment, bad debt, fraud and money laundering and support recovering debt or
tracing. Experian are promoting responsible lending consistent with the governing
principle of reciprocity by which CAIS were bound.
Mr Bendon
75. Mr Bendon is a product director at Experian working with the management team at
Experian. He is the product director for the Experian ChannelView product and co-
manager at ConsumerView with Ms Shearman.
76. He explained that ChannelView’s database is designed to collate contact information
for UK adults to help Experian’s clients deliver marketing to customers and
prospective customers. It differs from ConsumerView and Mosaic in that it does not
contain any insight data or other information that can be used to predict consumer
needs, interests and preferences and contains only contact information. Experian uses
ChannelView to link information held in ConsumerView and Mosaic to contact details
provided to Experian about its clients and/or suppliers. The contact information used
in ChannelView is obtained predominantly from third party data suppliers who
collect data from some 148 websites that people sign up to, usually in exchange for
access to offers and discounts, price comparison services and the availability to
participate in surveys or win prizes. The data from third party suppliers is provided
approximately every four weeks. The first step on receipt of the data is to separate out
the names, postal addresses, email addresses and mobile phone numbers from any
other data that was received, cleanse and enhance the data and understand the format
in which it is expressed. It is then cross-checked against the Experian “no marketing
requests” (“NMR”) file. Finally, Experian checks using tools to ensure that the newly
22
Appeal Number: EA/2020/0317
received data will not result in duplicate records appearing in ChannelView and cross-
check against its own internal databases.
77. ChannelView enables Experian’s clients to facilitate the linking of email addresses held
by clients with records in ConsumerView in circumstances where they would not
otherwise be able to do so (for example, because they had not collected their
consumers’ or contacts’ address data), allowing them to tailor their offerings to
maximise their appeal to their current customers and run more effective marketing or
other campaigns. This is permitted only where Experian considers the client has a
lawful basis for wanting to do so, for example the retailer may have a list of email
addresses and use ChannelView to connect those records with ConsumerView to give
it a better understanding of likely needs and preferences. Clients who receive data
from ChannelView are contractually obliged to use it only for the purposes agreed in
advance. Where a client uses EMS data to enrich data that it holds about its customer
base, it operates as a controller and is therefore responsible for transparency in relation
to its customers, including informing them that it is enriching their data.
78. Mr Bendon explained the CIP is designed to provide a detailed overview of the
processing undertaken by Experian for ChannelView as well as ConsumerView and
Mosaic in terms of information on a number of topics. The CIP is not structured as a
single web page or document, with the exception of the Article 14 notice, which
appears as a pop up whenever somebody first clicks on the page but is structured to
be a series of connecting web pages or layouts to make it more accessible to readers.
We were taken through the structure of the CIP, particularly the front page and the
initial statement which is followed by an explanatory video.
79. Mr Bendon’s evidence is that there are prominent links throughout the CIP through
which individuals can choose to opt out of having their data processed by Experian
which takes them into a webpage entitled “your opt-out options”. There are also links
to a “help” page and an FAQs page on each page. Experian commissioned consumer
testing on the CIP to find out whether users did in fact find it easy to use. This was
done using a focus group model organised by C-Space and highlighted some action
points that needed to improve, the ease with which the CIP might be accessed, and
that further clarity should be provided regarding Mosaic, which was done.
80. There was a further online survey in June 2021. There has been quantitative research
including some 1,500 plus individuals asking them to go direct to and navigate
around/from various web pages. Of those who responded to the surveys, 72% were
able to locate the CIP from Experian’s homepage within the suggested timeframe of
one minute and without any guidance, with 77% of those indicating in response to
multiple choice questions that it was easy to find.
81. 90% of respondents indicated that they found it easy to understand the CIP front page,
a further 8% of respondents indicated they understood the information but did not
consider it easy to understand and only 2% of respondents indicated they did not
understand the information. 84% of respondents found that the introductory video
was easy to understand, a further 10% of respondents indicated they understood it but
23
Appeal Number: EA/2020/0317
did not consider it easy to understand and only 2% indicated that they did not
understand it. Mr Bendon then went on to explain how the data was used and was
understood, as were the sections on “your data rights”, “who uses our services” and
“how we protect your data”. 94% were able to locate the opt out button from the
introductory page and 93% found it easy to understand the opt out information. We
consider that this is a useful exercise although not definitive.
82. Mr Bendon considered that the purposes for which Experian’s data are processed are
relatively innocuous and not intrusive and that the research showed the majority of
respondents viewed Experian’s processing of CRA derived data as acceptable, as
shown by the C-Space June 2021 survey.
83. Mr Bendon submitted also that the legitimate interest assessments were justified, and
Experian’s processes were robust. He said that potential issues are identified as part
of the process and resolved. He also gave examples as to how things have been
changed since the original version including amendments to Mosaic and
ConsumerView, including one change intended to reduce the risk of inadvertently
processing special category data.
Mr Cresswell
84. Mr Cresswell is a data protection and privacy lead for Experian but he is not
specifically attached to EMS.
85. He stated that promoting transparency for data subjects is important to Experian. He
explained that Experian does not have a direct relationship with any of the data
subjects about improvements to processing data apart from by the CIP and the
customer services team, which arises only when somebody chooses to contact them.
For that reason he does not have a pre-existing channel through which he could
communicate with data subjects in the way that he could if the business was engaged
directly with consumers but that this challenge has not deterred Experian in seeking
to promote transparency but has, on the contrary, prompted them to redouble their
efforts to ensure processing is transparent, done through setting up the online portal
which can be accessed in many ways, and ensuring that the CRAIN, an industry
standard notice, is provided to all customers and makes specific reference to Experian
activities including a link to the CIP and ensuring that its third party suppliers include
in their transparency information explanation and information as to how their data
will be shared with marketing services providers, including Experian, as well as a link
to the CIP.
86. Experian estimates that collectively the measures it has taken have resulted in more
than 90% of the people about whom it processes non-public personal data having
received information regarding such processing, most of them being sent that
information on several occasions. Of the small minority that did not receive links to
the CIP and/or the CRAIN, significant numbers will be notified by other channels that
their data will be used for marketing purposes. This occurs for example and most
frequently when people sign up to the open electoral register. There is a significant
number of people covered by this process.
24
Appeal Number: EA/2020/0317
87. Mr Cresswell said that when the GDPR came into force the concept of transparency
was untested and that Experian sought to be proactive from the outset and to work
closely with Information Commissioner to make sure that Experian was meeting the
regulatory requirements and explaining the steps they had taken over time. He said
that they had taken steps to make the CIP easily digestible, breaking it down into
manageable sections. Such steps included taking a layered approach, as indicated by
the EDPB’s guidelines on transparency in order to avoid information fatigue and
setting out information in an easy to read manner using accessible language.
88. He rejected the submission that the language used was unduly euphemistic or
industry based and that the word “insight” simply bore its natural meaning of
understanding or awareness. He drew attention to the video which was easy to
understand and that examples were given to aid understanding.
89. Mr Cresswell stated that there are approximately 920,000 visitors a month to the
Experian homepage and approximately 7 million visits a month to their website more
generally. Links by which consumers can access the CIP appear at the top of every
page of Experian’s website. He noted that between 26 March 2020 and 26 July 2020
there were hard searches, meaning a complete search of an individual’s credit report
against 22,547,105 unique individuals using the CRA database, each of which have
been presented with a link through to the CIP through the CRAIN and that individuals
have also been provided with the same link when applying for credit through lenders
which use other CRAs apart from Experian as they all use the same CRAIN.
90. Turning to Experian Customer Services (“ECS”), which has both paid and free
services, this has a separate privacy policy. ECS had sent emails to 7.5 million existing
customers informing them about the changes to privacy policy as well as another 2.2
million individuals, who had signed up since then.
91. Mr Cresswell explained the CRAIN. It had initially been launched in 2017 as part of a
combined effort of all other major UK CRAs to comply with the GDPR. It had been
revised since then and he explained how CRA derived data may be used for marketing
purposes drawing attention to paragraph 2(h) which provides:
“Each credit reference agency offers its clients marketing services. Some of these
marketing services may use credit reference data and some do not. Details about
the marketing services offered and the personal data used by the credit reference
agencies please see the following links.”
This then provides a link to the CIP explaining also the ways in which the information
may be used:
“If a credit reference agency provides marketing services then they may use an
individual’s title, name (including aliases), address, date of birth, gender, address
links information (see Section 4 for more detail) as well as limited information
relating to those financial standing. Further information is given as to how the
information is then used.”
25
Appeal Number: EA/2020/0317
92. Mr Cresswell said that the CRAIN is deliberately drafted in such a way as to make it
accessible using clear and intelligible language.
93. With regard to third party data suppliers, these fall into three different categories.
Those who provide Experian with publicly available non-personal data, those that
provide Experian with publicly available personal data and those that provide
Experian with data they collected directly from consumers or via their own suppliers.
Transparency information is provided in all three cases, for example drawing attention
to the fact that the Registry Trust works with Experian.
94. In cross-examination in dealing with category C suppliers, Mr Cresswell said they no
longer have suppliers who collect data on a consent basis and then transfer the data to
be processed on the basis of legitimate interest.
95. Mr Cresswell said that Experian seeks to promote transparency for data subjects and
to promote the accuracy of its data which it checks using various methods, including
comparisons of data, drawing attention to the fact that the ConsumerView database is
rebuilt from scratch every month as is ChannelView and that data is properly secured.
96. Turning to the safeguarding of data subjects’ rights he said that consumers wishing to
restrict the processing of data can opt out but that in a typical year Experian receives
about 5,000 opt out requests, of which 70% (clarified in cross-examination) were made
via the CIP, this being a small number of visits to the CIP, which is in itself since it was
introduced has had a little over 83,000 visitors. This figure being confirmed from
individual IP addresses so it may not be entirely accurate. He said there may also be
a small number of people who opted out in writing rather than through the website.
He explained that there are two main ways in which people can opt out and that most
who contact Experian with regards to their right to erasure actually want to limit the
processing of their data for the purposes of providing the targeted advertising. He
explained that this achieves a better outcome for them than by them opting out
completely and having their name added to the NMR file because if their data is
completely erased and their name is not added to Experian’s non-prospectable file
there would be no way they could flag them in the future to prevent them from
receiving marketing material that they did not wish to receive. The difficulty being
that opting out entirely means that they would get taken out of any database including
the suppression file. On average only ten data subjects a year go through this process
to require complete erasure.
26
Appeal Number: EA/2020/0317
Colin Grieves
97. Colin Grieves is the managing director of the UK marketing services business of
Experian. His evidence is that the Information Commissioner has misconstrued what
Experian does and the importance of its products to clients. He stated that the volume
of direct mail that a UK adult receives on average as a result of their data being used
by Experian (and where the entity sending the mail has no pre-existing relationship)
is 1.8 pieces per annum and that over half the population receives zero pieces in this
manner.
98. Mr Grieves said that offline marketing is highly effective. A study on the average
return on investment generated by direct mail is approximately 29%, roughly
comparable to the average return on investment generated by social media advertising
and ahead of the return on investment generated by search advertising and online
display advertising. He also said that it may afford organisations better scope to reach
the target audience and other forms of marketing depending on the type of product,
for example using multiple channels simultaneously may increase the effectiveness.
He said also in some circumstances online marketing is not an option because the
organisation wants to target people who do not have access to or regularly use the
internet. He also said that within internet marketing, it is often the case that an
advertiser has to bid to show material to individuals, so the advertisement goes to the
highest bidder, making it difficult for small organisations to compete.
99. Mr Grieves also said that cutting down the volume of irrelevant communications has
a positive benefit, and they estimate that their products help stop 1 billion
communications that could be said to be irrelevant due to a change of address or that
the consumer has died in any year from entering the system.
100. Mr Grieves said the consequence of implementing the Information Commissioner
requirements within the enforcement notice would be severe and the requirements
were not specifically clear to Experian. With regard to requirement 1 it would require
setting up an internal project team, engaging with third parties, to review and advise
on the info graphics, it would take approximately 220 working days on the part of
Experian plus incurred third party costs. He considered this Information
Commissioner requirement would not necessarily benefit consumers, there being a
risk of information overload.
101. If Experian were to cease using CRA derived data for marketing processes, it may need
to close down the effective parts of its business, so a considerable amount of time
would be spent redesigning it with costs in excess of £1.66 million and an extensive
contractual negotiation with clients. If they were no longer able to provide clients with
the services Experian had been contracted to deliver then they would need to have
revised terms of business. No longer being able to use the CRA data for validation
would make their products less valuable and would reduce confidence in their
accuracy; the extent to which they could filter out data subjects under 18; and, inhibit
the ability to prevent communications being sent to people who have changed address
or died. If Experian was no longer able to use the CRA data for matching and linking,
27
Appeal Number: EA/2020/0317
Experian could not amend and enrich its clients’ and its own data as effectively as it
does at present; and looking to other sources of personal data to support its matching
and linking activities, such as OER, Companies House and County Court judgments
register, would be far less effective. The requirement seems to indicate that even that
processing would not be with a legitimate interest. Experian would no longer be able
to provide credit pre-screening. Overall, the business would be at risk.
102. The requirement to provide privacy notices to all the UK adults whose data is held
would result in a significant cost. The estimated cost was at 16.9 million GBP including
the cost of an external printing house printing the notifications, postage costs and in-
house support. There would also need to be provision for an influx of queries that
would follow using a call centre. He estimated that the total costs might run to £37.7
million given the increased number of individual records and the necessary
recruitment and training of staff to handle calls. EMS made a profit of approximately
£9 million in the most recent financial year and thus it would take between four or five
years to recoup the cost measures making this aspect of the business unviable.
103. Experian’s assessment of the likely damage to its business was supported by Mr David
Parker who gave his evidence to us and was cross-examined.
The Information Commissioner’s Witnesses
Mr Hulme
104. We heard from Mr Hulme who is a director of regulatory assurance, a role he has held
since 5 November 2018. In his witness statement he explains the context of the
Information Commissioner’s investigation explaining that in 2015 the Information
Commissioner began gathering intelligence about the processing of personal data and
the data broking sector identifying three main credit reference agencies as the main
hubs for buying and selling of personal data.
105. When cross-examined Mr Hulme accepted, having considered again the enforcement
notice, that the actual true to life data points and the number of them is an important
consideration. It was important to know the difference between those which are
actual, as opposed to presumptive, and that assumptive data may not reflect the
factual position. He agreed that Experian did not know in any particular case whether
their assumptions were right or wrong and neither did their clients and that the
assumptions made (as opposed to actual data) about someone’s actual interests could
be equally as intrusive.
106. Mr Hulme was unable to state whether, in the course of his investigation, the
Information Commissioner had made any efforts to ascertain the proportion of actual
true to life data points being processed as opposed to the assumptive data points. He
accepted that the data points held were quite limited and did not include the true to
life online or offline interests or habits of the person concerned, and there were no
other tracking data. Turning to the enforcement notices at [76], he said that questions
of scale in terms of the number of data subjects is not going to affect the intrusiveness
question for the individual. Asked about the second bullet point within paragraph
28
Appeal Number: EA/2020/0317
[76], he did not accept this was limited despite it being put to him that he had
considered thirteen data points was not wide. He accepted that all the data from the
OER, Companies House, and County Court judgments was public and freely
available. He was unable to say that the Information Commissioner had failed to focus
on whether the actual data points were limited. It was put to him, and he accepted,
that it would not be remotely surprising to people that their name and address (data
which appears in the OER) would be used to update marketing lists, as ensuring
accuracy would not come as a surprise.
107. He accepted the Information Commissioner did not reflect in the enforcement notice
the terms within which individuals permit the data to be processed on the OER. He
accepted the fact that just under 50% of the name and address data processed is
derived from the OER, or individuals providing their data, not something that the
Enforcement Notice reflected on, and he accepted he did not know at the time how
many people engaged or provided data through third party suppliers. He accepted
that Experian only processes CRA data on three points and he accepted the data was
never used within the business to enable clients to identify new prospectable targets.
He accepted that he did not know that this was the case at the time, but he could not
speak for others.
108. Asked if it would have been an important question to put to Experian that “We want
to understand whether your use of credit reference agency data enables new targets,
new prospectable types to be identified, can you tell us the answer?”, he conceded that
this would have been an important question. He did not know if the Information
Commissioner was aware of the fact that CRA data is never provided to clients at all.
He accepted that the fact that Experian did not provide CRA data to clients was a
hugely important consideration, but he further accepted that it allowed Experian to
make marketing suppression lists. It was put to him it was only because they
processed the CRA data that they could apply a suppression list so as to prevent
marketing materials being sent to individuals within the suppression lists such as mail
preference services, telephone preference services and so on, including the credit
suppression list.
109. He accepted that this means that the processing of CRA data would enable Experian
to ensure that its clients are respecting the marketing choices made by consumers as
to their suppression choices. He accepted that consumers did benefit and he agreed
that potentially, processing CRA data is something that protects individuals from
distressing outcomes, a matter not reflected in the enforcement notice. He accepted it
was not reflected in the notice. He denied that there had been an unfair concentration
on the detriments rather than the benefits for data subjects. It was put to him that the
reason that the enforcement notice did not deal with any of the benefits of processing
data was because the Information Commissioner failed to recognise the way in which
it processed data was capable of benefitting individuals.
29
Appeal Number: EA/2020/0317
Mr Reynolds
110. Mr Reynolds’ evidence is that he is an economist and that he gave his opinion to the
Information Commissioner who employs him, which had gone into the decision under
appeal. He had looked at the economic arguments submitted by Experian overnight.
He accepted that the Information Commissioner had not put in reply evidence to
Experian’s expert evidence as to the economic impact, or the statements from Mr
Grieves or Mr Parker. He accepted that he had not been asked to produce an impact
assessment and that he had not had time to do so, his email as disclosed being just a
summary of Experian’s case.
The Tribunal’s Function
111. Sections 162 and 163 Data Protection Act provide:
162 Rights of appeal
(1) A person who is given any of the following notices may appeal to the Tribunal—
(a) an information notice;
(b) an assessment notice;
(c) an enforcement notice;
(d) a penalty notice;
(e) a penalty variation notice.
(2) A person who is given an enforcement notice may appeal to the Tribunal against the
refusal of an application under section 153 for the cancellation or variation of the notice.
(3) A person who is given a penalty notice or a penalty variation notice may appeal to the
Tribunal against the amount of the penalty specified in the notice, whether or not the
person appeals against the notice.
(4) Where a determination is made under section 174 in respect of the processing of
personal data, the controller or processor may appeal to the Tribunal against the
determination.
163 Determination of appeals
(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section
162(1) or (3).
(2) The Tribunal may review any determination of fact on which the notice or decision
against which the appeal is brought was based.
(3) If the Tribunal considers—
(a) that the notice or decision against which the appeal is brought is not in accordance
with the law, or
(b) to the extent that the notice or decision involved an exercise of discretion by the
Commissioner, that the Commissioner ought to have exercised the discretion
differently, the Tribunal must allow the appeal or substitute another notice or decision
which the Commissioner could have given or made.
(4) Otherwise, the Tribunal must dismiss the appeal.
30
Appeal Number: EA/2020/0317
(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement
notice ought to be cancelled or varied by reason of a change in circumstances, the
Tribunal must cancel or vary the notice.
(6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's
determination.
112. We observe, as a preliminary matter, that there is a distinction between Section
163(3)(a) “Is not in accordance with the law” as opposed to (b) or "ought to have
exercised the discretion differently.”
113. It is for the appellant to establish that the Information Commissioner’s decision is not
in accordance with the law. We note it is a rare case in which the burden of proof will
be a legitimate route to a decision.
114. We note also sections 149 and 150 of the DPA18. It follows from these that before an
enforcement notice is issued, information must be considered where relying on Section
149(2) as follows:
(1) The person to whom the notice may be issued is the data controller or processor.
(2) There has been a failure to comply with the legislation set out in one more of A
to E above.
(3) Then the Information Commissioner must decide whether to exercise their
discretion to give an enforcement notice.
(4) If so, the Information Commissioner must decide the requirements which the
Information Commissioner considers appropriate, for the purpose of remedying
the failure and any requirements to refrain from taking specified steps.
115. We turn first to the issue of whether the enforcement notice is in accordance with the
law. We observed before that it is not in dispute that Experian is a data controller or
that it processes data.
116. We then turn to the requirements of the law, as set out in the UK GDPR which, so far
as it applies to this appeal, does not differ materially from the EU’s GDPR. We have,
however, taken into our consideration the various recitals to the EU GDPR to which
we have been referred as an aid to interpretation.
Article 4 (11)
‘consent’ of the data subject means any freely given, specific, informed and unambiguous
indication of the data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal data relating to him or
her;
31
Appeal Number: EA/2020/0317
Article 5
Principles relating to processing of personal data
Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject
(‘lawfulness, fairness and transparency’);
(b) collected for specified, explicit and legitimate purposes and not further processed in a
manner that is incompatible with those purposes; further processing for archiving purposes
in the public interest, scientific or historical research purposes or statistical purposes shall, in
accordance with Article 89(1), not be considered to be incompatible with the initial purposes
(‘purpose limitation’);
Article 6 1
Lawfulness of processing
1. Processing shall be lawful only if and to the extent that at least one of the following
applies:
(a) the data subject has given consent to the processing of his or her personal data for one
or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is
subject;
(d) processing is necessary in order to protect the vital interests of the data subject or of
another natural person;
(e) processing is necessary for the performance of a task carried out in the public interest
or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by the
controller or by a third party, except where such interests are overridden by the interests
or fundamental rights and freedoms of the data subject which require protection of
personal data, in particular where the data subject is a child.
Point (f) of the first subparagraph shall not apply to processing carried out by public
authorities in the performance of their tasks.
Article 7 Conditions for consent
1. Where processing is based on consent, the controller shall be able to demonstrate that the
data subject has consented to processing of his or her personal data.
2. If the data subject’s consent is given in the context of a written declaration which also
concerns other matters, the request for consent shall be presented in a manner which is
clearly distinguishable from the other matters, in an intelligible and easily accessible
form, using clear and plain language. Any part of such a declaration which constitutes an
infringement of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his or her consent at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal. Prior to giving consent, the data subject shall be informed thereof.
It shall be as easy to withdraw as to give consent.
4. When assessing whether consent is freely given, utmost account shall be taken of
whether, inter alia, the performance of a contract, including the provision of a service, is
32
Appeal Number: EA/2020/0317
conditional on consent to the processing of personal data that is not necessary for the
performance of that contract.
Article 12
Transparent information, communication and modalities for the exercise of the rights of the
data subject
1. The controller shall take appropriate measures to provide any information referred to in
Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to
processing to the data subject in a concise, transparent, intelligible and easily accessible
form, using clear and plain language, in particular for any information addressed
specifically to a child. The information shall be provided in writing, or by other means,
including, where appropriate, by electronic means. When requested by the data subject,
the information may be provided orally, provided that the identity of the data subject is
proven by other means.
2. The controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In
the cases referred to in Article 11(2), the controller shall not refuse to act on the request of
the data subject for exercising his or her rights under Articles 15 to 22, unless the
controller demonstrates that it is not in a position to identify the data subject.
Article 13 Information to be provided where personal data are collected from the data subject
1. Where personal data relating to a data subject are collected from the data subject, the
controller shall, at the time when personal data are obtained, provide the data subject
with all of the following information:
(a) the identity and the contact details of the controller and, where applicable, of the
controller’s representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing;
(d) where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, the fact that the controller intends to transfer personal data to a
third country or international organisation and the existence or absence of relevant
adequacy regulations under section 17A of the 2018 Act, or in the case of transfers
referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to
the appropriate or suitable safeguards and the means by which to obtain a copy of them
or where they have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall, at the time
when personal data are obtained, provide the data subject with the following further
information necessary to ensure fair and transparent processing:
(a) the period for which the personal data will be stored, or if that is not possible, the
criteria used to determine that period;
(b) the existence of the right to request from the controller access to and rectification or
erasure of personal data or restriction of processing concerning the data subject or to
object to processing as well as the right to data portability;
(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2),
the existence of the right to withdraw consent at any time, without affecting the
lawfulness of processing based on consent before its withdrawal;
33
Appeal Number: EA/2020/0317
(d) the right to lodge a complaint with a the Commissioner;
(e) whether the provision of personal data is a statutory or contractual requirement, or a
requirement necessary to enter into a contract, as well as whether the data subject is
obliged to provide the personal data and of the possible consequences of failure to
provide such data;
(f) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic
involved, as well as the significance and the envisaged consequences of such processing
for the data subject.
3. Where the controller intends to further process the personal data for a purpose other
than that for which the personal data were collected, the controller shall provide the
data subject prior to that further processing with information on that other purpose and
with any relevant further information as referred to in paragraph 2.
4. Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has
the information.
Article 14
Information to be provided where personal data have not been obtained from the data subject
1. Where personal data have not been obtained from the data subject, the controller shall
provide the data subject with the following information:
(a) the identity and the contact details of the controller and, where applicable, of the
controller’s representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the
legal basis for the processing;
(d) the categories of personal data concerned;
(e) the recipients or categories of recipients of the personal data, if any;
(f) where applicable, that the controller intends to transfer personal data to a recipient in a
third country or international organisation and the existence or absence of relevant
adequacy regulations under section 17A of the 2018 Act, or in the case of transfers referred
to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the
appropriate or suitable safeguards and the means to obtain a copy of them or where they
have been made available.
2. In addition to the information referred to in paragraph 1, the controller shall provide the
data subject with the following information necessary to ensure fair and transparent
processing in respect of the data subject:
(a) the period for which the personal data will be stored, or if that is not possible, the
criteria used to determine that period;
(b) where the processing is based on point (f) of Article 6(1), the legitimate interests
pursued by the controller or by a third party;
(c) the existence of the right to request from the controller access to and rectification or
erasure of personal data or restriction of processing concerning the data subject and to
object to processing as well as the right to data portability;
(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the
existence of the right to withdraw consent at any time, without affecting the lawfulness of
processing based on consent before its withdrawal;
(e) the right to lodge a complaint with the Commissioner;
(f) from which source the personal data originate, and if applicable, whether it came from
publicly accessible sources;
34
Appeal Number: EA/2020/0317
(g) the existence of automated decision-making, including profiling, referred to in Article
22(1) and (4) and, at least in those cases, meaningful information about the logic involved,
as well as the significance and the envisaged consequences of such processing for the data
subject.
3. The controller shall provide the information referred to in paragraphs 1 and 2:
(a) within a reasonable period after obtaining the personal data, but at the latest within one
month, having regard to the specific circumstances in which the personal data are
processed;
(b) if the personal data are to be used for communication with the data subject, at the latest
at the time of the first communication to that data subject; or
(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are
first disclosed.
4. Where the controller intends to further process the personal data for a purpose other than
that for which the personal data were obtained, the controller shall provide the data subject
prior to that further processing with information on that other purpose and with any
relevant further information as referred to in paragraph 2.
5. Paragraphs 1 to 4 shall not apply where and insofar as:
(a) the data subject already has the information;
(b) the provision of such information proves impossible or would involve a
disproportionate effort, in particular for processing for archiving purposes in the public
interest, scientific or historical research purposes or statistical purposes, subject to the
conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred
to in paragraph 1 of this Article is likely to render impossible or seriously impair the
achievement of the objectives of that processing. In such cases the controller shall take
appropriate measures to protect the data subject’s rights and freedoms and legitimate
interests, including making the information publicly available;
(c) obtaining or disclosure is expressly laid down a provision of domestic law which
provides appropriate measures to protect the data subject’s legitimate interests; or
(d) where the personal data must remain confidential subject to an obligation of
professional secrecy regulated by domestic law, including a statutory obligation of secrecy.
117. We accept that our task is to identify whether there have been any failures to comply
with the legislation and that we are not bound to agree with the Information
Commissioner. The relevant parts of the law to consider whether Experian complied
are set out in DPA18 149(2) see (2)(a) and (b); Subsections (c), (d) and (e) are not
relevant in the circumstances in this case. Broadly, the Information Commissioner
relies on contraventions of the data protection principles set out in Article 5 GDPR and
in relation to the rights of data subjects provided for in chapter 3. These contraventions
are set out in paragraphs 27-75 of the enforcement notice (prior to Experian’s response
on the papers). For the reasons to which we turn below, we know there have been a
number of significant concessions in evidence and explanations given by Experian’s
witnesses, which shed further light on the factual circumstances of the case.
118. Turning next to a detailed consideration of the law, we observe that at recital 47, the
GDPR recognises that direct marketing may (our emphasis) be regarded as a legitimate
interest. A recital is an aid to interpreting the substantive provisions; in any event, the
legitimate interest test, balancing the interests of the data controller and the individual
must be carried out to determine whether direct marketing does amount to a legitimate
interest in the applicable circumstances.
35
Appeal Number: EA/2020/0317
119. We accept the Information Commissioner’s submission that the right to transparency
in the processing of personal data is foundational as it enables data subjects to access
and exercise their own GDPR rights. We accept it is essential to affording data subjects
autonomy and to achieving the purpose of the GDPR that a person should have control
of their own personal data.
120. The Information Commissioner characterises Experian as a data broker (which
Experian vigorously denies) although the Commissioner accepts that being a data
broker is a lawful and legitimate basis for business.
121. With respect to the requirements of transparency, we find that Mr Hulme’s evidence
on this makes little sense. Given how it is defined, what is or is not transparent will be
fact-specific and context related. The level of transparency required, for example,
when sharing intimate health details will not be the same as people consenting to the
processing of, for example, data about their preferred supermarket.
122. The Information Commissioner emphasises in the notice of decision the particular
need for transparency on the part of Experian.
123. Returning to the role of the Tribunal we note that our role is to stand in the shoes of
the Commissioner; a procedural error on the part of the Commissioner would not
cause the appeal to succeed but may be a factor taken into account in considering
whether discretion ought to have been exercised differently.
124. With regard to the deference which the panel should place on the views of the
regulator, the Tribunal does not simply disregard the decision of the expert regulator,
see R (Hope and Glory Public House Limited) v City of Westminster Magistrates’
Court [2011] EWCA Civ 31 (as approved in Ali (Iraq) v SSHD [2016] UKSC 60).
125. Toulson LJ held in Hope and Glory [45]:
45. Given all the variables, the proper conclusion to the first question can only be stated in very
general terms. It is right in all cases that the magistrates' court should pay careful attention to
the reasons given by the licensing authority for arriving at the decision under appeal, bearing in
mind that Parliament has chosen to place responsibility for making such decisions on local
authorities. The weight which the magistrates should ultimately attach to those reasons must be
a matter for their judgment in all the circumstances, taking into account the fullness and clarity
of the reasons, the nature of the issues and the evidence given on the appeal.
126. We note in passing, however, that the facts in Ali are significantly different from those
here; they concerned the deportation of foreign criminals where the Secretary of State
had adopted a policy in the general assessment of proportionality, in particular that a
custodial sentence of four years or more represents such a serious level of offending
that the public interest in deportation almost was outweighing countervailing
consideration.
127. Leave.EU Group Limited [2021] (UKUT 26) AAC, heard before a three judge panel,
was a case in which [113] it was not in dispute before the First Tier Tribunal (the “FtT”)
that the Commissioner’s decision making paper trail for the assessment notice was
36
Appeal Number: EA/2020/0317
absent from the appeal bundle and it was conceded by Counsel for the Information
Commissioner in the circumstances the Commissioner could not expect the FtT to give
weight to the reasoning for an expert independent regulator precisely because
evidence of such reasoning was lacking. The Upper Tribunal observed also [116] that
the FtT, like us, had the advantage of weighing the oral evidence of the witnesses along
with copious documentation in the appeal bundles.
128. Whilst we understand why counsel for the Information Commissioner would wish to
distance himself from Mr Hulme’s evidence, nonetheless, it has the effect of there being
little or no evidence to support some of the positions taken in the enforcement notice;
and, for reasons to which we will turn below, there are a number of factual errors
identified in the enforcement notice. In addition, in his cross-examination Mr Hulme
accepted that the scenarios set out in his witness statement as to how people would be
distressed by the data processing were incorrect to the extent that he accepted his
evidence in his witness statement was “completely wrong, completely misleading and
perverse”. Despite this, we did not feel the need to give ourselves a “Lucas” direction.
129. Mr Hulme accepted also that the report that the Information Commissioner had
compiled in respect to data broking, not specifically Experian, failed to present a
balanced account of Experian’s processing and he accepted it did not include any of
the benefits of its processing for data subjects in wider society. He did not, however,
agree that it was as good as useless.
Findings
130. We consider it appropriate to set out our findings as to what Experian does with the
data it collects. That position became clearer during the course of the hearing. We then
consider whether and to what extent that processing is contrary to the law. In doing
so, we bear in mind that EMS’s processing of personal data is not based on consent but
on legitimate interests.
131. We have been assisted by the parties’ preparation of a schedule of agreed and disputed
facts.
132. We note the contention as to whether Experian is a “data broker”. We are not,
however, satisfied that is a determinative issue, given that what is relevant in this
appeal is that Experian is a data controller. However, to the extent that it is relevant,
we note the evidence, and we find that, as is submitted by Experian, its business is
more in the line of producing marketing services. That is for two principal reasons:
first it provides tailored information to its clients to allow them to allocate resources
and fashion offerings to maximise their appeal; and, second in the light of what is said
by Ms Shearman, to run more effective marketing and communication campaigns.
Experian is not just providing lists of names and addresses; it adds a significant
amount of material to the individual profiles – “the attributes”.
133. We accept that Experian’s credit reference agency business is well-known. We take
notice of the fact that we have observed marketing carried out on television and on
billboards. We consider, however, that it would be speculative to consider how well-
37
Appeal Number: EA/2020/0317
known their marketing business, EMS, is. We note Mr Grieves’ evidence that Experian
presents itself as a business that processes credit data, sharing data and providing
access to offers. We note the submission that over 17 million individuals will have
interacted with third party websites that supply data to Experian and will thus have
seen the reference to the Experian privacy notice, but we do not accept that that is good
evidence that that number of people will be aware of EMS. That is because of the other
evidence, on which Experian relies. We accept also that approximately 10 million
people will have been notified of the existence of Experian if they had been in direct
contact with ECS but how much that impinged on their awareness we do not know.
134. Insofar as we can attach weight to the Information Commissioner’s position as a
regulator, and to the extent to which they can be shown deference, we consider that to
a significant extent, that does not absolve us from our duty to make findings of fact.
Nor does it absolve the Information Commissioner from reaching its conclusions on
the basis of evidence. We recall that we stand in the shoes of the Information
Commissioner and we are of course concerned with evidence.
135. The core of the Information Commissioner’s case is that the processing undertaken by
Experian will be surprising to those individuals whose personal data is processed, the
processing is intrusive, and that the assessments undertaken in balancing Experian’s
legitimate interests are flawed.
136. We found Mr Hulme’s evidence to be significantly flawed in a number of respects. As
noted above he accepted that in certain core parts of his evidence what he had said in
his witness statement was not just wrong but that the position was in fact the direct
opposite of what he had said in that witness statement to which his statement of truth
had been appended.
137. The evidence of Mr Reynolds was of limited assistance. That is not because we criticise
him but due to the superficiality of what he had to say. We see no harm in an
economist employed by the Information Commissioner being asked, as he was, to have
a brief overview of economic evidence provided by Experian in this case. Indeed, it is
sensible to get a rough overview of whether the material is relevant and how much
work needs to be undertaken to analyse it and, where appropriate, provide a response.
But, and this is not a criticism of him, this did not occur. Nothing further was asked
for beyond a brief overview. That said, an analysis of the economic impact of Experian
is a factor in assessing whether Experian’s processing of data is lawful, and the
requirements imposed on them albeit not a conclusive factor.
138. We accept the submission that in order for weight to be attached to the Information
Commissioner’s opinion that it has to be based in evidence. We accept also that in
reaching a decision, the Commissioner and this panel must have regard to the
regulatory decisions in respect of the economy, the environmental impact and positive
benefits for the consumers of processing (which appear from Mr Hulme’s evidence not
to have been taken into account in the enforcement notice).
38
Appeal Number: EA/2020/0317
139. Further, we accept it is difficult to accept as evidence capable of bearing weight either
the survey carried out by Experian or the Harris survey carried out by the Information
Commissioner as both use, in order to obtain data, what are best described as “loaded”
questions.
140. As noted above, Experian operates three products relevant to the notice:
ConsumerView; ChannelView and Mosaic. The pre-screening product is separate
from these and is offered only to members of the CAIS. Experian has no direct
relationship with the individuals whose data it processes save for those with whom it
may also have a direct relationship through ECS.
141. ConsumerView is, as is noted above, a product which combines the name and address
information for some 51 million UK adults with predicted socio-economic and
behavioural characteristics. Not all of the profiles will contain the maximum number
of thirteen actual attributes and many of those are obtained from sources which are
publicly accessible such as the open electoral register, the Registry Trust (in respect of
county court judgments), and Companies House. Three data points (buildings
insurance renewal month, contents insurance renewal month and motor insurance
renewal month) are not derived from public sources and one data point, that is
prospectable, being a person’s date of birth, can be derived either from a public source
(the OER) or from a non-public source such as a third party suppliers.
142. It is part of the Information Commissioner’s case that individuals on the OER would
find Experian’s use of their data surprising. The source for that is primarily Mr Hulme
whose evidence is, for the reasons set out above, less than reliable. It is not in reality
grounded in evidence but is supposition. Further, the mere fact that some people
might subjectively find some things “surprising” is not a particularly useful yardstick.
143. That said, we must form our own view of how Experian uses the data. In doing so we
bear in mind the data processing principles, in particular principle 2, as these form the
backdrop as to an individual’s expectations.
144. We accept, as is clear from the sample profiles shown to us, that ConsumerView
profiles will include up to 49 derived data points about individuals and up to 370
modelled points about individuals. These are, as Experian submits, predictions about
the likelihood of people having certain characteristics. We consider it is unhelpful for
the Information Commissioner to use emotive terms such as “judgments” about
people when describing modelled data points.
145. We bear in mind the evidence, as accepted to an extent by Mr Hulme, that modelled
data points may not in fact reflect a person’s actual characteristics. This, we find,
makes them less intrusive than processing actual data. We accept the evidence from
Ms Shearman that in ConsumerView the value for a newspaper readership is
attributed and not based on any actual data.
146. As noted above, there is a difference between records which are “prospectable” which
means that a name and postal address will be shared by Experian with customers who
do not already have that name and address to assist them to reach new businesses and
39
Appeal Number: EA/2020/0317
other records that are non-prospectable, which means that the name and address data
will not be shared but information concerning them can be shared with customers who
already have those individuals’ names and addresses. It is important to note that the
data obtained via CRA is not prospectable. We note also Ms Shearman’s evidence that
data may be marked as non-prospectable if individuals appear on Experian’s NMR file
or other industry suppression files such as mail preference and telephone preference.
That said, if an individual is marked as non-prospectable, then that will not affect the
nature and range of that data that is held about the person unless they apply to have
their data removed which, as the evidence demonstrates, applies only to a very small
number of people.
147. With regard to how the ConsumerView database is used by clients of Experian, if they
send a list of individual names and ask Experian to enrich it from the ConsumerView
database, Experian will use both prospectable and non-prospectable records in
answering the request albeit that the information provided to the customer will only
have attributes and propensities added and not the name and address (unless of course
this is already held). In other circumstances, Experian’s clients may request records
containing those attributes and propensities which are of most relevance to their
organisation, e.g. whether a customer is more or less likely than average to be
interested in direct mail, or what age group they might be in. In response, Experian
will provide such clients with prospectable records.
148. The information held on ChannelView is predominately provided to Experian by
various third-party data suppliers who, between them, collect data from some 148
websites in return for access to offers and discounts, price comparison services, the
ability to participate in surveys and so on. There are records on ChannelView for at
least 24 million individuals although the number will fluctuate over time. It is used in
order to link information held in ConsumerView with records provided to Experian
by its customers and suppliers. Mosaic uses data from public and commercial sources
in order to attribute households into fifteen overarching groups of 66 types. One
source of the information for that is the individual profiles on ConsumerView and the
Mosaic codes are appended to the individual level profiles in ConsumerView.
CRA-derived Data
149. The use of this data is, we accept, sensitive. As Experian accepts, it is difficult to
participate in modern life without having one’s data processed by a CRA and thus
individuals have little or no choice about providing their personal data to Experian.
150. Having considered carefully Ms Shearman’s evidence along with that of Mr Parker
and bearing in mind that Ms Shearman only joined Experian in 2006, we find that there
is insufficient evidence before us to permit us to conclude that the use of CRA data by
Experian was to make up for the fact that the full electoral register is no longer
available. In any event, as noted above, such data is not prospectable and is not
therefore used in the same way. Thus, this type of data cannot be used in the same way
as data from the full electoral register.
151. We accept that this data does provide Experian with a competitive advantage.
40
Appeal Number: EA/2020/0317
152. We accept that the CRA-derived data is used to validate or update address data, and
in the creation of Experian’s models. It is important to note that EMS does not have
access to any account transaction data. We accept the evidence that there are benefits
to data being used in such a way. It ensures that the mailing lists are up-to-date, which
in turn means that mailing is not sent to former addresses which may in itself be
problematic if it were then to be accessible by those who should not have access to it,
depending on what material is in a mailshot. We accept also that it has a utility in that
it allows businesses to, as Experian’s evidence indicates, cut down on duplicate names,
misspellings and similar errors. There are therefore benefits to this. We note that Mr
Hulme accepted these were benefits, and we note that offering a service to check
accuracy is supporting compliance with the accuracy principle.
153. Looking at the evidence as a whole we consider that the Information Commissioner
did not properly appreciate the limited extent to which CRA data was used. However,
we do note that this source of data is used to produce the ConsumerView profiles even
if the address information is not prospectable. The CRA data is therefore, to an extent,
used in the building up of Experian’s products.
154. We consider that the credit pre-screening product is of use in that it removes people
from marketing lists for credit products in circumstances where they would likely to
be declined as is the evidence from Experian’s witnesses. We accept that this does not
prevent people from applying for the credit product, merely that material is not sent
to them. We consider that there is a utility in this because it means that they will not
be offered products which (a) might not be affordable for them (b) where a refusal may
cause difficulties for their credit score with an ongoing difficulty, spiralling, in
obtaining credit. We accept the evidence from Ms Shearman and Mr Cresswell that it
was unlikely that the information provided by Experian would be used for multiple
successive campaigns as a matter of commercial judgments. That is because those who
would potentially receive the offer may have changed since the credit pre-screening
was first conducted, credit scoring being dated, given the requirement on the part of
the lender to use accurate data and the product may well be different. We observe also
that an individual’s credit rating may go up as well as down. We accept that the FCA
does not require firms to process data held by CRA to screen people out, but Experian
has never said that that is a requirement, and we note that the PRA and the FCA have
confirmed that the service offered is beneficial and helps lenders comply with the
FCA’s rules which we consider is a matter in the public interest.
155. We do not accept the emotive evidence from Mr Hulme that the use of CRA data to
screen individuals stigmatises poor people. We accept Experian’s evidence that, in a
number of cases, the requirement that Experian could process credit data only when it
obtained consent beforehand would limit the utility of suppression lists into which
people had opted as that data could not be linked.
156. We accept also Experian’s submission that what its clients are seeking to do is not to
target particular individuals but merely to have a list of those who are more likely to
respond to the offer their client intends to send. That is to say that the chances of direct
mail marketing being effective are higher by sending mail to a list of individuals who
41
Appeal Number: EA/2020/0317
may have particular characteristics, which is better than sending them at random.
Experian’s customers are, we accept, interested in the aggregated picture and we bear
in mind that this is not a situation, unlike some direct online marketing, where the
buying habits of particular individuals are known. We accept Mr Grieves’s evidence
that retailers do not pore over the names and addresses from ConsumerView.
157. With regard to the amount of data sent out, we accept the evidence from Experian that
on average four attributes are provided to clients; that data representing the last
twenty attributes and that impact of this fact is that they do not sell the entire data
profile of a cohort of data subjects. We accept Ms Shearman’s evidence that each
disclosure of data by Experian to a client is considered on a case-by-case basis subject
to controls including whether it is to be used for a permitted purpose as agreed in the
contract. We accept also that there is some auditing of the use to which the data is put
and Experian contracts with data brokers contain audit rights requiring the brokers to
provide monthly reports on the use of data. We accept also that there are red and
amber lists of organisations with whom Experian will not do business or may well not
do business, and we note the evidence that the only gambling company which is a
customer of Experian uses the service to prevent underage people from gambling. One
might have thought that was in the public interest but that too must be balanced.
158. We consider it difficult to quantify how much material would or would not be sent if
Experian’s activities were curtailed. We consider the suggestion that Experian’s
products help stop one billion communications to be excessive and not properly
sourced in evidence. We accept Mr Grieves’ evidence that some of the suppression
services may act to prevent stress in certain circumstances and we note, worryingly,
that Mr Hulme accepted that proposition and, in the example, whereby marketing was
sent to pregnant mother who had suffered a miscarriage that his statement was
perverse, wrong and misleading in this regard.
159. With regard to the evidence whereby those who might be in fuel poverty are identified,
and the suggestion that may be problematic, we note that such data might, if used by
utility companies and relevant service providers be in the public interest.
160. Finally, we accept the submission that the worst outcome of Experian’s processing in
terms of what happens to the data at the end of the process is that an individual is
likely to get a marketing leaflet which might align to their interests rather than be
irrelevant. To some extent we accept that the effect of suppression lists and removing
certain types of data may result in some people not receiving distressing or
inappropriate communication. That does not of course mean that there has been
compliance with the DPA or the GDPR but, following Lloyd v Google LLC [2021]
UKSC 50, it is unlikely that there would, in this scenario, be a data subject who is likely
to succeed in a damages claim.
CRAIN
161. The route for an individual to learn what happens to data acquired via the CRA
involves following a link from material supplied by, for example, a bank to the CRAIN
and from there to the CIP maintained by Experian. The great majority of lenders make
42
Appeal Number: EA/2020/0317
the CRAIN available to individuals by providing them with a link from their own
privacy notice. We accept Experian’s position that this route was decided after
consultation with the Information Commissioner. The Information Commissioner
were also, we accept in the light of the evidence of Mr Cresswell and Mr Hulme,
involved in the development of the CRAIN and considered that it was a good
transparency notice. We find, examining it that it provides individuals with an
understanding of Experian’s business and links to further material.
162. The route noted above will usually be facilitated by hyperlinks if the material from the
bank, as is often the case, is supplied in electronic form. We consider that the
reasonable data subject will be familiar with hyperlinks and how to follow them.
Consumer Information Portal
163. We were taken at length through the consumer information portal (CIP) which we
accept now includes a freestanding notice collating the information required to be
provided by Article 14. That was introduced in October 2020 at the same time as the
issue was noticed by the Information Commissioner. It has been amended so that it
no longer pops up only on a user’s first visit but also on subsequent visits to the site.
164. The Information Commissioner’s case is that Experian made no attempt to identify the
information that individuals were likely to find concerning or surprising and did not
address its mind to the questions of what steps it should take to ensure the information
was promptly located in the CIP.
165. Stepping back from the particular circumstances of this case, there is a tension between
providing large amounts of information on the one hand with the aim of improving
transparency and accessibility of information and on the other the resultant
information overload. To an extent that is met by layering which is the staggering of
provision of information to the customer, which is more easily adapted to a website
scenario. That is because an individual accessing it can see headlines and click on them
for more information. Whether, and to what extent, a particular piece of information
is surprising or for that matter important or unusual will be a matter of judgment. It
is self-evident that not all users will take the same view, nor will their knowledge as
to how data is processed in general be the same. Put bluntly, what surprises one
person may not surprise another but what is in issue is an individual’s reasonable
expectations.
166. We accept the evidence that Experian’s website receives some 7 million visits per
month but equally that only 130,000 unique IP addresses have visited the CIP since
April 2018. There is no evidence regarding the number of visitors to the CIP who have
gone beyond the first layer. This is borne out to an extent by the research data which
shows that actually most people do not care about what happens to their data.
167. With regard to the opt out option we do not consider that people are improperly
pushed towards not opting out totally.
43
Appeal Number: EA/2020/0317
168. We note the evidence that a report from the Competition & Markets Authority
suggests that on average individuals spend 73 seconds reading a privacy policy. In
that context, it is more likely than not that most people will not assimilate the substance
of the entire policy in that time. That is of course a matter of individual choice.
169. Common sense would tend to suggest that it is only those who are actually interested
in what happens to their data who would read beyond the first part of a privacy notice
and, if they were concerned to read further, we consider that there is a sufficiently easy
to follow trail through hyperlinks to the CIP from the privacy notices which enables
people who are concerned about their privacy to follow that route to learn more. If
people are not concerned about their privacy or what happens to their data, and they
must be assumed to know those people are going to process it, then to a significant
extent that is their choice. It may not be the choice of others or particularly data
professionals but you cannot force people into reading privacy policies and the data
controller is still obligated to provide a privacy notice. The processing must still be fair,
lawful and transparent. Compliance with Data Protection law is the core focus and
function of the Information Commissioner and therefore the Tribunal on appeal.
170. There are, we consider, difficulties with the basis upon which data obtained by third-
party suppliers was previously processed by Experian. We do, however, note the
evidence that the model used is now that data is processed on the basis of legitimate
interests and not on the basis of consent. That issue would thus appear now to be
academic.
171. There is a significant difficulty in moving data acquired on a consent basis – the model
by which the third-party suppliers acquire it, and that data being used by Experian on
the grounds of legitimate interests. To a significant extent those two bases are different
and there is significant merit in the Information Commissioner’s submission that the
consent is not valid as it would not actually specify how the data was going to be used
when transferred to Experian and therefore the consent would not be fully informed.
Such a model also causes considerable difficulty regarding what the effect of a consent
withdrawal would be.
Has there been a breach as the Information Commissioner submits?
172. We turn next to whether, in the light of these findings, Experian has failed to comply
with the GDPR as the Information Commissioner claims.
173. The Enforcement Notice required Experian to provide all data subjects with an article
14 GDPR compliant privacy notice and to cease processing the personal data of any
data subject to whom an article 14 compliant notice has not been sent.
174. Experian, in ground 4 of its appeal, says that the requirements of the Enforcement
Notice are disproportionate and unfair. The Information Commissioner says that the
requirement of transparency is a high-level obligation.
175. The Tribunal finds that transparency is central to the GDPR. The relevant transparency
requirement here is the requirement to provide an article 14 notice. The GDPR is clear
44
Appeal Number: EA/2020/0317
about the limited circumstances in which the requirement to give an article 14 notice
may be avoided. These are set out in paragraph 5 of article 14:
5. Paragraphs 1 to 4 shall not apply where and insofar as:
a. the data subject already has the information;
b. the provision of such information proves impossible or would involve a
disproportionate effort, in particular for processing for archiving purposes in the
public interest, scientific or historical research purposes or statistical purposes,
subject to the conditions and safeguards referred to in Article 89(1) or in so far as
the obligation referred to in paragraph 1 of this Article is likely to render
impossible or seriously impair the achievement of the objectives of that processing.
In such cases the controller shall take appropriate measures to protect the data
subject's rights and freedoms and legitimate interests, including making the
information publicly available;
c. obtaining or disclosure is expressly laid down by a provision of domestic law
which provides appropriate measures to protect the data subject's legitimate
interests; or
d. where the personal data must remain confidential subject to an obligation of
professional secrecy regulated by domestic law, including a statutory obligation
of secrecy.
176. The Tribunal was presented with some difficulty in assessing the historic position in
terms of what the CIP actually said at the time the Enforcement Notice was issued by
the Information Commissioner because Experian had made changes during
negotiations with the Information Commissioner in the course of the investigation. We
note that the position is that both articles 13 and 14 lay down a timescale for the
provision of privacy notices. Neither party assisted us on the issue of the relevant
version for us to consider.
177. We do not consider that the Information Commissioner has provided us with evidence
that would allow us to conclude that the CIP was defective at the time of the
enforcement notice. We note also the relevance of the current position to the steps
which the Tribunal may now order. We find that the processing, so far as it relates to
CRA derived data, is now sufficiently transparent in the context of the privacy notices
which are served on those data subjects who provide CRA data to lenders. The
hyperlinks and websites are simple to follow, and we find, having considered the CIP
in detail, that in its current form, as provided to us, it is adequately clear. We do accept
that the scale of the processing undertaken is very large, and that is something which
would be surprising to data subjects as indeed would be the uses to which that data is
put when considering the purposes for which it was collected. But, having considered
the CIP, we consider that the relevant information is sufficiently prominently
displayed and accessible to data subjects who want to understand how their data will
be processed.
178. Experian has accepted that around 5.3 million data subjects, out of the circa 51 million
data subjects whose information is processed by Experian, have not received a privacy
notice but contends that Experian can rely on paragraph 5 of article 14 on the basis that
45
Appeal Number: EA/2020/0317
the provision of such information would involve a disproportionate effort. The GDPR
is clearly written so that the article 14 privacy notice requirement cannot be easily
avoided and so that ‘disproportionate effort’ is to be construed narrowly. Whilst we
note that we are not bound by it, we have had regard to the Article 29 Working Party
guidance on Transparency as adopted by the European Data Protection Board. In the
context of the GDPR, the fact that notifying the 5.3 million data subjects would involve
a considerable business expense does not mean that it would be a disproportionate
effort for the purposes of article 14 GDPR. That is a business expense which should
have been incurred over time as a matter of routine compliance. If the costs of
compliance were higher than Experian considered acceptable, then Experian was free
to take a business decision not to undertake the processing. We find that Experian
should have provided the residual cohort with an article 14 privacy notice and did not
do so. It was therefore non-compliant in that respect.
179. On that basis, we find that there has been a contravention of the GDPR in respect of
that cohort in that the processing has not been transparent, fair or lawful.
180. We find also that there has, in the past, been a contravention of the GDPR with respect
to the data obtained from third-party suppliers where that material was obtained on a
consent basis, and we do not accept that legitimate interests is a proper means by
which that data could have been used by Experian for the purpose it was processed.
But we accept that this no longer occurs.
181. We do not find that there has been any other material contravention.
182. We therefore turn next to what enforcement notice if any, should be substituted and
what steps the Tribunal should order. In doing so, we remind ourselves that the steps
must be proportionate.
183. In so doing, we must stand in the shoes of the Information Commissioner and ask
whether the Information Commissioner should have exercised her discretion
differently. A broader concept of proportionality comes into the exercise of discretion
by the Information Commissioner which involves a consideration of what could be
achieved by imposing a requirement that Experian should rectify its non-compliance
by providing a privacy notice to the residual cohort. The answer to that question is
that it would be informing the data subjects about the use of their personal data as they
were entitled to be informed previously and that this could enable them to object if
they so wished. It would also prevent Experian from benefitting from non-compliance
by having saved business costs by not providing an article 14 notice. It would also
potentially dissuade other Data Controllers from non-compliance, but the main object
of the enforcement notice would be to make sure that Experian would comply with
the GDPR in the future.
184. We find that the Information Commissioner should have exercised her discretion
differently in that she should have balanced the objectives in issuing the enforcement
notice against (a) the fact that the uses to which the personal data were put did not
result in adverse outcomes for the data subjects, (b) the economic impact that the
46
Appeal Number: EA/2020/0317
expense would have on Experian when incurred at once rather than over months or
years, and (c) the likely reaction of the data subjects to receiving an ‘out of the blue’
notification, which reaction we find was likely to be either disinterest resulting, for
example, in the data subject just putting it in the bin or possibly some confusion or
even distress. We are satisfied that the Information Commissioner got the balance
wrong in terms of proportionality in exercising her discretion because the Information
Commissioner had fundamentally misunderstood the actual outcomes of Experian’s
processing. We note in particular that section 150(2) provides ‘In deciding whether to
give an enforcement notice in reliance on section 149(2), the Information
Commissioner must consider whether the failure has caused or is likely to cause any
person damage or distress’.
185. The Tribunal must also consider what steps it will order now, and we find that to order
notification of the residual cohort now would be disproportionate. However, the
Tribunal would stress that it has made a finding that Experian did not comply with
the requirements of article 14 and it fully expects that Experian will rectify this non-
compliance in respect of its future personal data collections. The Tribunal recognises
the considerable expense and practical difficulties which Experian would face in
attempting to identify the residual cohort and issue them with an article 14 notice.
186. The Tribunal is cognisant of the fact that some of the personal data has been used to
build models from which Experian may continue to derive a commercial benefit. Any
processing of personal data collected in circumstances where an article 14 privacy
notice should have been given and has not been given will continue to be non-
compliant and Experian should consider what it can do to discontinue this processing.
This applies even where the personal data has ceased to be personal data because its
inclusion in the models is anonymised. It is clear that taking personal data and
anonymising it is a form of processing of personal data and that processing must be
compliant. However, the Tribunal cannot order steps which are unclear or incapable
of implementation.
187. The Tribunal is also satisfied that it is unlikely that any person has suffered damage or
distress as a result of Experian’s failure to provide an article 14 notice.
Coda
All members of the panel have contributed to the writing of this decision.
An embargoed copy of this decision was circulated to the parties to ensure that no closed
material was inadvertently included. No closed decision has been necessary. We are grateful
to the parties for their suggested corrections and clarifications, and in attempting to agree a
substituted Enforcement Notice.
Signed Date 17 February 2023
Jeremy K H Rintoul
Upper Tribunal Judge Rintoul
(sitting as a judge of the First-tier Tribunal)
47