Doorstep Dispensaree Limited v The Information Commissioner

On an appeal against a penalty notice under section 163 of the Data Protection Act 2018, the appellant bears the burden of proof throughout unless the statute provides otherwise. A full merits review remains a fresh decision, but that does not remove the burden. The tribunal must determine facts and law for itself. At the penalty stage, however, it may sometimes give weight to the Commissioner’s views in the penalty notice, having regard to the Commissioner’s statutory role, knowledge and experience. That weight cannot improve the force of factual findings or legal arguments merely because they came from the Commissioner. The appeal was dismissed.

The Information Commissioner imposed a £275,000 penalty on a pharmacy under section 155 of the Data Protection Act 2018 for breaches of the GDPR concerning the storage, security and transparency of personal data. On appeal, the First-tier Tribunal upheld the breaches but reduced the penalty to £92,000. The Upper Tribunal dismissed a further appeal: [2023] UKUT 132 (AAC). The pharmacy appealed to the Court of Appeal, challenging the allocation of the burden of proof and the weight given to the Commissioner’s penalty notice. The central questions were whether the appellant bore the burden in a full merits appeal and whether the tribunal could take account of the Commissioner’s regulatory expertise when assessing the penalty.

1. Appeal dismissed. The three-member Court of Appeal agreed with the judgment of Newey LJ.
2. On an appeal under section 163 of the Data Protection Act 2018 against a penalty imposed under section 155, the burden of establishing the grounds of appeal lies on the appellant. The general principle in Khan v Customs and Excise Commissioners [2006] EWCA Civ 89 applied. The same approach was supported by Brady v Group Lotus Car Companies plc [1987] 3 All ER 1050 and R (Hope and Glory) v City of Westminster Magistrates’ Court [2011] EWCA Civ 31.
3. A full merits review requires the First-tier Tribunal to decide the matter afresh. It does not mean that neither party bears the burden of proof. The evidential burden is a practical description of how evidence may affect the hearing; it does not displace the strict burden, which remains on the appellant. The tribunal will usually decide the case on the balance of probabilities without needing to rely expressly on that burden.
4. The tribunal must decide for itself whether the statutory contravention occurred. A factual finding cannot receive additional weight merely because it appears in the Commissioner’s penalty notice, and a legal argument is not strengthened by its source. At the penalty stage, however, it may be lawful to attach some weight to the Commissioner’s views on matters such as gravity, harm, effectiveness and deterrence. The tribunal must consider the circumstances, including the fullness and clarity of the reasons, the issues, the evidence, and the Commissioner’s statutory functions and expertise.
5. Judge Macmillan had made her own factual findings and had not treated the burden of proof as determinative. Her approach to the penalty was selective and critical rather than automatic: she rejected the Commissioner’s document estimate and excluded Article 24(1) as a contravention for which a penalty notice could be imposed. Any weight given to the Commissioner’s conclusions at the penalty stage was permissible.

• Court of Appeal (Civil Division): dismissed the appeal against the Upper Tribunal’s decision.
• Upper Tribunal (Administrative Appeals Chamber): dismissed DDL’s appeal in the decision dated 1 June 2023, cited as [2023] UKUT 132 (AAC).
• First-tier Tribunal (General Regulatory Chamber): allowed the appeal in part, upheld the relevant GDPR breaches and reduced the penalty from £275,000 to £92,000 in a decision dated 9 August 2021 and promulgated on 18 August 2021.