Doorstep Dispensaree Ltd v The Information Commissioner

On an appeal against a monetary penalty notice under the Data Protection Act 2018, disputed facts are ordinarily resolved by the civil standard of proof. A substantial financial penalty, without more, does not create the serious consequences requiring the criminal standard. The First-tier Tribunal must decide the facts and merits for itself, but must pay careful attention to the regulator’s decision and reasons. That does not require deference or any predetermined weight. The GDPR provides the applicable framework for controller and processor responsibility; domestic agency law is not imported into that framework. A breach of Article 32 necessarily involves a failure of the wider Article 24(1) duty, so reliance on Article 24(1), where immaterial to the penalty assessment, does not necessarily constitute an error of law.

Doorstep Dispensaree Ltd appealed to the Upper Tribunal against the First-tier Tribunal’s dismissal of its appeal against a monetary penalty notice and enforcement notice issued by the Information Commissioner. The First-tier Tribunal reduced the penalty from £275,000 to £92,000 after finding that substantially fewer documents were affected, but upheld the penalty in principle.

The appeal raised seven grounds, including the burden and standard of proof, the weight to be given to the Commissioner’s decision, controller and processor responsibility, reliance on Article 24(1) of the GDPR, penalty assessment, factual findings and delay in promulgating the First-tier Tribunal’s decision. The central legal issue was whether the First-tier Tribunal had erred on a point of law.

1. Appeal dismissed. The First-tier Tribunal had not erred on a point of law.
2. The First-tier Tribunal was required to decide for itself whether the statutory conditions for a monetary penalty notice were met, whether a penalty was appropriate and what amount should be imposed. Describing the burden of proof as of secondary importance in a full merits review did not mean that the validity of the notice was presumed. The Commissioner had to present an evidential case, while the Tribunal retained responsibility for finding the facts and exercising its discretion afresh.
3. A tribunal hearing an appeal against a regulatory decision should pay careful attention to the decision and reasons under challenge. This does not prescribe the weight to be given to them. Weight remains a matter for the tribunal in light of the evidence, the issues and the quality of the reasons.
4. Under domestic law, the civil standard applies to disputed facts in monetary penalty notice proceedings. The serious-consequences category identified in Re B is principally illustrated by proceedings restricting liberty where breach may itself constitute a criminal offence. A potentially large financial penalty, without more, does not satisfy that category.
5. Even if such proceedings constitute determination of a criminal charge for Article 6 purposes, Article 6 does not mandate the domestic criminal standard of proof. The statutory scheme, considered as a whole, was compatible with the fair-trial guarantees.
6. The GDPR’s autonomous and Union-wide framework did not import domestic agency-law principles into the controller-processor relationship. The Tribunal was entitled to determine responsibility by reference to the GDPR.
7. The Article 24(1) finding did not materially affect either the decision to impose a penalty or its amount. Article 32 is a penalisable breach and a breach of Article 32 necessarily entails failure to implement measures required by Article 24(1). The Tribunal’s penalty reasoning relied on the Article 32 and Article 5 breaches and other aggravating factors.
8. The remaining challenges concerned factual evaluation, credibility, procedural fairness and delay. They disclosed no legal error. Delay alone was insufficient, and the credibility finding was based on recorded inconsistencies rather than demeanour.

• Upper Tribunal (Administrative Appeals Chamber): appeal dismissed; the First-tier Tribunal’s decision of 9 August 2021 did not involve an error on a point of law.
• First-tier Tribunal (Information Rights): the appeal against the enforcement notice was dismissed. The monetary penalty appeal succeeded only as to amount, which was reduced to £92,000.