United Kingdom: Dismissed Information Commissioner Appeal of UK Upper Tribunal (Administrative Appeals Chamber) in case against Experian for alleged unlawful processing of data

On 22 April 2024, the UK Upper Tribunal (Administrative Appeals Chamber) dismissed the Information Commissioner's Appeal of the ruling of the First-Tier Tribunal (Information Rights) in its case against Experian for alleged unlawful processing of data. The Information Commissioner's Office (ICO) required Experian Limited, a credit reference agency, to change its practices concerning personal data. In particular, it had been found that Experian had unfairly and unlawfully processed the personal data of over 5 million individuals by failing to notify them that it was processing their data for direct marketing purposes. Experian had been ordered to provide all data subjects with a privacy notice informing them of Experian's processing of their personal data for direct marketing purposes. The First-Tier Tribunal found Experian to have breached the GDPR in terms of transparency and proper use of data collected under consent, but the tribunal regarded the punishment as too severe due to the absence of harm to the data subjects. The Information Commissioner appealed this decision, which was dismissed by the UK Upper Tribunal.