Nearly five years into the life of the GDPR/DPA 2018 regime, the dust is finally settling on the first monetary penalty notice issued by the ICO under that regime. This was against Doorstep Dispensaree, whose multiple challenges to that MPN have finally run aground.

Panopticon reported on the Upper Tribunal stage of this saga. In short: pharmacy; 47 boxes of hard copy documents containing inter alia prescription records left in an accessible yard; ICO unimpressed; £275k fine. The FTT and UT dismissed the appeals, and, last week, the Court of Appeal took the same view. Here are the short key points.

Issue 1: where does the burden of proof lie in an appeal against a MPN? Answer: on the Doorstep, i.e. on the appellant throughout (para 41). See e.g. para 39: “The Commissioner must before raising a penalty notice be satisfied that one of the conditions specified in section 155(1)(a) and (b) is met and that it is appropriate to require the person to pay the penalty. Where, however, the recipient of a penalty notice appeals under section 163, it seems to me to be incumbent on him to persuade the FTT that the penalty should not stand”.

Issue 2: what weight should be given to the reasons given by the ICO? Again, the Court of Appeal upheld the decisions below. The FTT should make up its own mind on findings of fact (para 56):

“To the extent that the point turned on the facts, the FTT would have to make up its own mind on the basis of the evidence before it. Nor could an argument as to the law gain any extra weight because it had been incorporated in the penalty notice. There could, of course, be no objection to the FTT adopting a contention advanced in the penalty notice if it found it convincing, but the fact that the source was the Commissioner could not improve it. The FTT would be endorsing it because it assessed it as correct, not because the Commissioner had put it forward. A legal argument will be no better (or worse) on account of being presented by the Commissioner.”

However, depending on the facts it may be proper for the FTT to attach some weight to exercises of discretion by an expert regulator like the ICO (para 57). That is particularly likely to be the case as regards the application of the Article 83 GDPR factors, e.g. what constitutes an ‘effective and dissuasive’ penalty, or on issues such as ‘gravity’ and ‘harm’ (para 58).

PTA to the Supreme Court refused. This door is now closed.

11KBW’s Peter Lockley, led by Ben Jaffey KC, appeared for the ICO.

Robin Hopkins