Doorstep Dispensaree Limited v The Information Commissioner

The Court of Appeal dismissed the appellant's challenge to the Upper Tribunal. The principal legal points decided were (i) that on an appeal under section 163 of the Data Protection Act 2018 the evidential and legal burden of proof remains on the appellant to show the penalty should not stand and (ii) that the First‑tier Tribunal may, in determining whether to impose a penalty and what amount is appropriate, attach some weight to the views and reasoning given by the Information Commissioner in a penalty notice, provided that the Tribunal retains its independent merits review and does not treat the Commissioner's views as determinative on questions of primary fact or law.

The court applied Article 5, Article 24 and Article 32 of the UK GDPR (storage limitation, controller responsibility and security of processing) and Article 83 GDPR (criteria for administrative fines) together with sections 149, 155, 162 and 163 of the Data Protection Act 2018. On the facts, the FTT’s findings that Doorstep Dispensaree was the controller, that personal and special category data had been insecurely stored and retained longer than necessary, and that a reduced but substantial penalty was appropriate were not shown to be wrong.

Background and parties: The appellant, Doorstep Dispensaree Limited (DDL), a pharmacy using Joogee Pharma Limited (JPL) as a processor for waste and document destruction, was issued with a penalty notice of £275,000 by the Information Commissioner under section 155 of the Data Protection Act 2018 after the MHRA executed a search warrant at premises where tens of thousands of documents, many containing special category health data, were found.

Nature of the application: DDL appealed the penalty to the First‑tier Tribunal (FTT). The FTT allowed the appeal in part, reducing the penalty to £92,000. The Upper Tribunal dismissed DDL’s further appeal. DDL sought permission to appeal to the Court of Appeal. The Court considered two principal legal issues:

• Who bears the burden of proof on an appeal under section 163 of the DPA?
• Whether the FTT may attach weight to reasoning and assessments expressed by the Commissioner in a penalty notice when deciding whether to impose a penalty and its amount.

Issues framed by the court: (i) the incidence and role of the burden of proof on a full merits review under section 163; (ii) the permissible weight, if any, that an appellate tribunal may give to the Commissioner’s reasoning in a penalty notice.

Court’s reasoning and disposition: The court reviewed authorities (notably Khan v Customs and Excise Commissioners and Brady) and concluded that the ordinary presumption is that the appellant bears the burden of proof in appeals against enforcement action and that the DPA does not impliedly reverse that position for penalty appeals. The fact that the FTT conducts a fresh merits review is compatible with the burden lying on the appellant. On the second issue the court accepted established authorities that an appellate body may properly pay careful attention to, and in some circumstances attach weight to, a primary decision-maker’s reasons (examples from licensing and immigration law were considered). The court explained that the FTT must decide questions of fact and law for itself and cannot allow the Commissioner’s views to carry extra weight on questions of primary fact or legal interpretation simply because they appear in the penalty notice. However, where the Commissioner’s views reflect relevant regulatory expertise and experience — for instance in assessing gravity, dissuasiveness and comparability of penalties under Article 83(1) and (2) UK GDPR — it can be permissible for a tribunal to take those views into account when exercising its discretion as to penalty quantum. Applying those principles, the court found no error in the FTT judge’s approach or findings and dismissed the appeal.

Procedural path: FTT hearing (Judge Moira Macmillan) → Decision reducing penalty to £92,000 (9 August 2021) → Upper Tribunal appeal dismissed ([2023] UKUT 132 (AAC)) → Court of Appeal appeal dismissed ([2024] EWCA Civ 1515).

The appeal was dismissed. The Court of Appeal held that (1) on an appeal under section 163 of the Data Protection Act 2018 the evidential and legal burden of proof remains on the appellant to show the penalty should not stand, and (2) a tribunal hearing such an appeal may, when deciding whether to impose a penalty and the amount, attach weight to reasoned assessments in the Commissioner's penalty notice insofar as they reflect the Commissioner's regulatory expertise, provided the tribunal undertakes its independent full merits review and does not treat the Commissioner's views as determinative on primary fact or law. Applying these principles, the FTT and Upper Tribunal had not erred in law or in approach.

FTT (General Regulatory Chamber, Information Rights) decision (Judge Moira Macmillan) promulgated 18 August 2021 reducing the Commissioner’s penalty to £92,000; Upper Tribunal (Administrative Appeals Chamber) appeal dismissed by Judge Mitchell [2023] UKUT 132 (AAC); appeal to the Court of Appeal dismissed [2024] EWCA Civ 1515.