On April 23, 2024, the Administrative Appeals Chamber (Upper Tribunal) published its judgment, dismissing the Information Commissioner's Office (ICO) appeal against a First-tier Tribunal (FTT) decision that modified the terms of the ICO's enforcement notice against Experian.

Background to the case

In October 2020, the ICO issued an enforcement notice against Experian due to concerns that the company's data processing practices violated the General Data Protection Regulation (GDPR) transparency requirements. Experian appealed the enforcement notice and the FTT largely held in Experian's favor and modified the terms of the enforcement notice considerably.

The ICO then appealed this decision to the Upper Tribunal, arguing that the FTT did not properly address or apply the legal requirements of transparency to Experian's data processing activities. Specifically, the ICO challenged the adequacy of the information provided on Experian's Consumer Information Portal (CIP) and argued that it did not comply with the transparency obligations in Articles 5(1)(a) and 14 of the GDPR.

Findings of the Upper Tribunal

The Upper Tribunal dismissed the ICO's appeal, finding no legal error in the FTT's decision, and rejected the notion that the FTT had failed in its legal duty regarding transparency. The Upper Tribunal determined that while the FTT's reasoning could have been clearer, the FTT had sufficiently addressed the ICO's concerns about the layering and accessibility of privacy information on Experian's CIP. 

Outcomes

In light of the above, the Upper Tribunal upheld the FTT's decision and dismissed ICO's appeal.

You can read the judgment here.