DMA Analysis: The Upper Tier Tribunal rejects ICO appeal in the Experian Case. What does the verdict mean for DMA members?

The DMA welcomes the Upper Tier Tribunal judgement which has completely rejected the ICO’s appeal in its case versus Experian. The UTT ruling confirms the DMA’s interpretation of GDPR in the important areas of transparency and legitimate interests, giving greater certainty to the market. This is a milestone case that establishes important legal precedents.

The UTT confirms several important precedents for transparency and legitimate interests that will be of interest to DMA members, especially to brands who use offline direct marketing and the providers of third-party data and data solutions to enhance profiles or create prospecting files.

Commenting on the verdict on behalf of Experian, Colin Grieves, MD of Experian Marketing Services said: “We’re pleased the UTT saw fit to agree with the findings of the FTT which largely overturned the Enforcement Notice issued by the regulator. We have been consistent in our position that Experian shares the ICO’s belief in transparency in data use and choice for consumers. We have worked hard to deliver that and the FTT agree with us on the quality and extent of our approach, and the UTT did not interfere with those conclusions. As such the findings give clarity that Experian’s approach meets GDPR requirements. Critically marketing data provided by Experian based on legitimate interests is safe for brands to use.”

This supports the DMA’s long campaign to provide legal certainty for the use of legitimate interests as a lawful basis for the majority of direct marketing data processing. Government amendments to UK GDPR in the Data Protection and Digital Information Bill initiated by the DMA provide even greater certainty.

The DMA is also seeking legislative clarity on the transparency requirements for use of data from the Open Electoral Register for direct marketing. The original FTT ruling supported the ICO in a very narrow interpretation of the Article 14.5.b exception for disproportionate effort, and specifically that “costs” could not be considered a “disproportionate effort”.

A legislative amendment developed by DMA and a broad coalition of members led by CACI has been tabled in the House of Lords by Lady Harding and Lord Clement Jones with support from Baroness Jones, Lord Black and supported by many peers including Lord Arbuthnot, Lord Kamall, Baroness Stowell and Lord McNally. The amendment widens the scope of what is considered disproportionate effort to include to include “the effort and cost of compliance, the damage and distress to the data subjects, the reasonable expectations of the data subject and whether information has been collected and made publicly available by a public body”

The DMA also believes that exception that “the data subject already has the information” in Article 14.5. applies to the electoral register data as a result of the data notification and opt-out provided by local councils at the point of voter registration. The acceptance in the UTT judgement that links from third party websites meet the threshold of “already has the information” strengthens our belief that voters already have the information.

For the avoidance of doubt, the same coalition of peers working with the DMA has tabled a further amendment to DPDI which adds a clause 14.5.aa to GDPR. This clause that states that “the data is from the Open Electoral Register” as a further exception to the transparency and notification requirements.

To read the DMA’s full analysis of the Upper Tier Tribunal judgement, please click the link below:

Link to analysis