25 abril 2024 Technology - Telecoms, Media & Business Services - Corporate Governance - Dispute Resolution

Linklaters advises Experian on successful judgment affirming lawfulness of Experian’s marketing services in Upper Tribunal

Linklaters advised Experian on its successful judgment in the Upper Tribunal (UT) in Experian v Information Commissioner UA-2023-000512-GIA. The UT’s decision marks the end of one of the most significant data protection challenges to date, reinforcing the lawfulness of Experian’s marketing services business operations. The UT unequivocally found in favour of Experian, upholding the First Tier Tribunal (FTT)’s 2023 ruling, which largely overturned the Enforcement Notice (EN) issued by the Information Commissioner's Office (ICO) against Experian’s marketing services business.

This judgment confirms the lawfulness of Experian's data processing practices within its marketing services business and maintains the Substitute Enforcement Notice (SEN), which removed the majority of the ICO’s initial requirements. The SEN also substantially revised Experian’s obligation to notify individuals, requiring Experian to contact a substantially smaller group than previously demanded.

Key findings upheld:

  • Experian's privacy notices, accessible through the Consumer Information Portal (CIP), were deemed clear and accessible.
  • Indirect notification was ruled to be sufficient, allowing Experian to rely on notices issued by third-party data collectors.
  • Legitimate interests was reaffirmed as a valid ground for processing data in marketing contexts.
  • The FTT determined that it was unlikely that any individuals had suffered damage or distress due to the benign nature of Experian's data processing outcomes.

The UT's decision has broader implications for the marketing industry, emphasising the need for more detailed privacy information to be provided to individuals when their data is sourced from publicly available records, such as the Open Electoral Roll or Companies House. It also offers wider guidance on transparency, proportionality, and the use of electronic notices, which will greatly affect data controllers' operations.

A cross-practice team was led by TMT Partner Richard Cumbley, and Litigation, Arbitration and Investigations Partner Ben Packer. 

Richard Cumbley, TMT Partner, said:

“After six years of uncertainty, this judgment confirms that the marketing services Experian have provided for many years to UK businesses, government and the third sector remain legitimate and fair under the UK’s data protection regime. The judgment contains useful guidance on transparency and the extent to which businesses must go to be transparent.  Importantly the judgment reaffirms cost as one element that businesses can consider when assessing what they need to do.”

Ben Packer, Litigation, Arbitration and Investigations Partner, said:

“The original Enforcement Notice was struck out partly because of the ICO’s misunderstandings about what Experian’s marketing service business actually does. The regulator’s position is difficult. Large businesses have complex and nuanced processing operations and it is difficult for anyone not working within those businesses to have full command of the underlying detail. As such, it is easy to see the temptation to rely on high-level assumptions about how businesses operate. The FTT’s findings – which the UT has now upheld – demonstrate that there is no substitute for a close examination of the underlying data and fields and a concrete understanding of the exact processing taking place.”

Andrew Mills, Legal Director UK&I, at Experian said:

“As we have stated throughout these proceedings, we remain deeply committed to transparency, safeguarding privacy and helping data subjects to better understand and control the use of their data. We put an enormous amount of effort into developing our Consumer Information Portal, testing it with users and ensuring that our suppliers direct people to it. We’re delighted that the Tribunal has found that we are transparent and open in our marketing business. The judgment more generally has important implications for the marketing industry and the wider UK data protection regime. In particular, it is important that the marketing industry now adapts to the FTT’s guidance on using the Open Electoral Roll.”

A link to the Upper Tribunal’s judgment can be found here.