Anonymised Summary of Legal Opinion

Factual and Procedural Background

In 2017–2018 a cyber-attack targeted the systems of Company A (owner/operator of major retail brands). Over about nine months attackers "scraped" point‑of‑sale transaction data, storing and attempting to exfiltrate it. More than 5.6 million payment cards were affected; in roughly 8,000 instances attackers obtained PAN, expiry date and cardholder name, but in the majority only PAN and expiry date (EMV data), such that the attackers could not identify cardholders. The Commissioner investigated, found Company A in breach of DPP7 (the security duty under the Data Protection Act 1998) and issued a monetary penalty notice (MPN) for £500,000. Company A appealed to the First‑tier Tribunal (FtT), which rejected Company A's contention that DPP7 did not require ATOMs against third‑party acquisition of EMV data and upheld the MPN but halved the penalty. Company A succeeded on that point in the Upper Tribunal (UT), which held that whether third‑party acquisition was "processing of personal data" had to be assessed from the third party's perspective. The Commissioner obtained permission to appeal to this court on the single ground that the UT erred in law by holding a controller need not take ATOMs against third‑party processing where the data are personal in the controller's hands but not in the hands of the third party.

Legal Issues Presented

1. Whether the security duty (DPP7 under the Data Protection Act 1998) requires a data controller to take appropriate technical and organisational measures (ATOMs) to guard against unauthorised or unlawful processing by a third party of data that relate to individuals identifiable to the controller but not identifiable to that third party.
2. Whether the assessment of whether data are "personal data" for the purposes of DPP7 must be made from the controller's perspective or from the perspective of the third party potentially processing the data.

Arguments of the Parties

Appellant's (the Commissioner) Arguments

• The UT's interpretation was unduly narrow and inconsistent with the ordinary meaning and purpose of the statute and Directive.
• Interpreting DPP7 from the third‑party perspective would create gaps in protection (e.g. against malicious third‑party destruction/encryption) contrary to legislative purpose.
• Relevant case law does not support the UT's third‑party perspective as determinative for the security duty.

Respondent's (Company A) Arguments

• DPP7 does not require protection against third‑party processing where the third party cannot identify the individuals — the data would not be "personal data" in the third party's hands.
• The UT's approach follows statutory language and prior authority and avoids imposing burdens where data are effectively anonymous to third parties.

Table of Precedents Cited

Court's Reasoning and Analysis

The court construed the 1998 Act in its textual context and compatibly with the Directive. Key statutory terms (data, personal data, data controller, processing) were read from s 1 and s 4(4) together with DPP7. On their face, those provisions impose an unqualified duty on a controller in relation to all personal data of which it is controller, including category (b) data (identifiable from the data plus other information in the controller's possession). The court rejected the UT's narrowing device that would require assessing whether data are "personal" from the perspective of a potential third party. The Directive's broader definition of personal data (Recital 26 and Article 2) expands identifiability considerations but does not support treating DPP7 as limited to situations where third parties themselves can identify data subjects. The court analysed Article 17(1) of the Directive and concluded it encompasses a duty to guard against at least some non‑accidental third‑party processing of data that are personal to the controller. The court examined domestic FOI authorities (notably CSA) and EU jurisprudence (Scania; SRB v EDPS) and explained that CSA concerns deliberate anonymisation for public disclosure and does not determine the security‑duty issue here. The CJEU's analysis in SRB (and Scania) supports assessing the security duty primarily from the controller's perspective and recognising that data can be personal "for" the controller even if a particular third party lacks means of identification. The court further considered practical consequences (ransomware, data destruction/exfiltration) and held that the UT's interpretation would leave significant protection gaps inconsistent with legislative purpose. On that basis the court concluded the security duty requires ATOMs against third‑party processing of data that are personal to the controller even where the third party cannot identify the data subjects.

Holding and Implications

APPEAL ALLOWED.

The court allowed the Commissioner's appeal, concluded the UT erred in law, and remitted the matter to the First‑tier Tribunal for determination in accordance with this judgment. The core holding is that under the 1998 Act the security duty (DPP7) requires a data controller to take appropriate technical and organisational measures to protect personal data that are personal from the controller's perspective, including against unauthorised or unlawful processing by third parties who cannot themselves identify the data subjects. The court did not decide factual issues about whether Company A's measures were appropriate, nor did it determine the proportionality or amount of any penalty; those matters are for the FtT on remittal.

Author and Bench

The lead judgment (anonymised) set out above; Judge Laing and Judge Moylan agreed.