The Court of Appeal has allowed the Information Commissioner’s appeal, overturning the Upper Tribunal’s decision and remitting the case to the First-tier Tribunal for reconsideration, in the long-running enforcement action against DSG Retail Ltd.
For data protection practitioners, the judgment provides important clarification on how “personal data” is to be assessed under the Data Protection Act 1998 (DPA 1998), with obvious relevance to GDPR-era enforcement.
Background to the penalty
The underlying breach occurred in 2017, when malware was installed on 5,390 point-of-sale tills across DSG’s Currys PC World and Dixons Travel stores. The compromise persisted for approximately nine months.
The incident involved:
- 5.6 million payment card records (16-digit PANs and expiry dates)
- Personal data relating to approximately 14 million individuals
In 2020, the Information Commissioner’s Office issued a £500,000 monetary penalty notice (MPN), the statutory maximum under the DPA 1998. The Commissioner characterised the failings as relating to basic security controls.
DSG appealed the MPN. The procedural history is as follows:
- The First-tier Tribunal allowed the appeal in part, and reduced the penalty to £250,000
- The Upper Tribunal allowed a further appeal and ordered the matter to be reconsidered
- The Court of Appeal has now allowed the Commissioner’s appeal on the point of law and sent the case back to the First-tier Tribunal to be determined in line with its judgment.
The core legal issue
The appeal did not concern the wider personal dataset. Instead, it focused narrowly on whether payment card numbers and expiry dates — absent cardholder names — constituted “personal data” for the purposes of the DPA 1998.
DSG accepted that it could identify data subjects by linking the card data to its internal systems. However, it argued that the correct perspective was that of the malicious actor. If the attacker could not identify individuals from the compromised data alone, then the data should not be treated as personal data in that context.
The Upper Tribunal accepted that reasoning. The Court of Appeal did not.
Lord Justice Warby held that identifiability must be assessed from the perspective of the data controller, not the attacker.
Where the controller is able to identify individuals from the dataset it holds, the data falls within the statutory definition of personal data. The obligation to implement appropriate technical and organisational measures therefore attaches, regardless of whether a third party could immediately identify the individual from the compromised subset.
This is a significant clarification. It rejects any interpretation that would narrow regulatory protection based on the capabilities of a threat actor at a given moment.
The Court also addressed the risk of “jigsaw identification”. Even where a dataset does not directly identify an individual, it may do so when combined with other information reasonably likely to be available.
The judgment acknowledges the increased sophistication of data aggregation and cross-referencing technologies. In practical terms, it would be artificial — and potentially dangerous — to assess identifiability in isolation from the broader data ecosystem.
For practitioners, this reinforces a contextual and realistic approach to identifiability, consistent with broader EU data protection principles (including those reflected in Recital 26 GDPR), even though the case was decided under the DPA 1998.
Enforcement implications
Had the Upper Tribunal’s reasoning stood, it may have constrained enforcement in cases involving:
- Ransomware exfiltration of partial datasets
- Tokenised or pseudonymised data
- Payment card or financial identifiers without names.
The Court of Appeal’s judgment strengthens the regulator’s position in such scenarios. It confirms that organisations cannot rely on the technical limitations of an attacker to dilute their own compliance obligations.
The matter now returns to the First-tier Tribunal for reconsideration in light of the Court of Appeal’s ruling. DSG may seek permission to appeal further, potentially to the Supreme Court.
Practical takeaways for firms
For law firms advising corporate clients, the message is clear:
- Identifiability remains controller-focused
- Partial datasets can still constitute personal data
- Security obligations attach even where the compromised data appears incomplete.
For claimant practitioners, the judgment may also influence arguments around materiality and risk in group litigation arising from cyber incidents.
In short, the Court of Appeal has reaffirmed a broad and purposive interpretation of “personal data”. In an era of increasingly fragmented and aggregated data use, that clarity is likely to resonate well beyond this particular breach.
At Join the Claim, we will continue to track and translate developments like this, supporting both consumers and the firms representing them as collective redress continues to evolve.
