Fairness as a distinct test

The first principle has three parts: lawful, fair and transparent. Fairness is the one most often treated as a synonym for the other two. It is not. A process can have a valid lawful basis and a complete privacy notice and still be unfair, and fairness is often the ground a regulator reaches for when the other two are technically satisfied.

What fairness means

Fairness asks whether processing is something people would reasonably expect, and whether it has unjustified adverse effects on them. Three strands:

1. Expectations. Would a reasonable person in this relationship expect this use? Burying an unexpected use in a notice does not make it expected.
2. Effects. Does the processing cause detriment that is not justified by its purpose, such as discrimination, exclusion or financial harm?
3. Means. Was the data obtained honestly? Deception, pressure or dark patterns at the point of collection make what follows unfair however lawful the basis.

Where fairness bites

• Power imbalance. Employers, public authorities and dominant platforms face a higher bar, because people cannot easily walk away.
• Profiling and inference. Drawing conclusions people would not expect from data they gave for something else is a fairness problem even where the basis holds.
• Automated decisions. The UK GDPR safeguards for significant automated decisions, in Articles 22A to 22D since 2026-02-05, are fairness rules in statutory form.
• Children. A design that exploits a child’s inexperience is unfair. The Age Appropriate Design Code makes this concrete.
• Cookie walls and consent design. Making refusal harder than acceptance turns a consent mechanism into an unfair one.

Questions that expose an unfair process

• Would the person be surprised to learn this was happening?
• If they were surprised, would they be upset, and would they be right to be?
• Is the detriment proportionate to what the organisation gains?
• Could the same aim be met with less effect on the person?
• Has anyone in a weaker position than the organisation been asked?

Fairness and the DPIA

A DPIADPIAData protection impact assessment: a structured risk assessment required before processing likely to result in a high risk to people. is where fairness should be tested before launch, not argued after a complaint. Record the expectation analysis and the effects analysis explicitly. Regulators read a DPIA that never mentions fairness as evidence that it was never considered.

For a complaint

Fairness is the right ground when the organisation’s answer is “we had a lawful basis and it was in the notice”. Describe the expectation you had, why it was reasonable, and the effect on you. It is a judgement, so the facts carry it.