![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
England and Wales Court of Appeal (Civil Division) Decisions |
||||||||||
PLEASE SUPPORT BAILII & FREE ACCESS TO LAW
To maintain its current level of service, BAILII urgently needs the support of its users.
Since you use the site, please consider making a donation to celebrate BAILII's 25 years of providing free access to law. No contribution is too small. If every visitor this month gives just Β£5, it will have a significant impact on BAILII's ability to continue providing this vital service.
Thank you for your support! | ||||||||||
You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Doorstep Dispensaree Ltd v The Information Commissioner [2024] EWCA Civ 1515 (09 December 2024) URL: https://www.bailii.org/ew/cases/EWCA/Civ/2024/1515.html Cite as: [2024] EWCA Civ 1515, [2024] WLR(D) 553 |
[New search]
[Context]
[View without highlighting]
[Printable PDF version]
[View ICLR summary: [2024] WLR(D) 553]
[Help]
ON APPEAL FROM THE UPPER TRIBUNAL
(ADMINISTRATIVE APPEALS CHAMBER)
Upper Tribunal Judge Mitchell
[2023] UKUT 132 (AAC)
Strand, London, WC2A 2LL |
||
B e f o r e :
LADY JUSTICE ASPLIN
and
LORD JUSTICE STUART-SMITH
____________________
DOORSTEP DISPENSAREE LIMITED |
Appellant |
|
- and - |
||
THE INFORMATION COMMISSIONER |
Respondent |
____________________
Ben Jaffey KC and Peter Lockley (instructed by Information Commissioner's Office) for the Respondent
Hearing date: 21 November 2024
____________________
Crown Copyright ©
Lord Justice Newey:
"a. Articles 5(l)(f), 24(1) and 32 of the GDPR, in that [DDL] has failed to implement the appropriate organisational measures to ensure the appropriate security of the personal data it processes and has processed personal data in an insecure manner. It is also noted that Article 5(l)(e), which states that data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which they are processed, is likely to have been infringed;
b. Articles 13 and/or 14 GDPR, in that [DDL] has failed to provide data subjects with the information required by those Articles."
"The Commissioner understands that the data subjects are not aware of the Breach, but were they to become aware it could cause high levels of distress, although financial damage is unlikely. The infringements of Articles 13 and 14 may have caused distress in the form of confusion or uncertainty about [DDL's] processing of sensitive personal data."
"83 I am further satisfied that JPL allowed at least some of the data processed on behalf of DDL to be stored in unlocked crates, and at least some of these were stacked in an outside yard before the documents were recovered, as a result of which some of the documents became wet. I find in addition that the yard was not an appropriately secure area in which to store personal data, due to the fact that the yard could be accessed by the occupants of and visitors to three residential flats, via fire escapes that as a matter of common sense must be readily accessible. The unlocked crates in the yard could also potentially be accessed by business visitors to the Property. I conclude from this that JPL's methods of data storage was not appropriately secure and did not afford sufficient protection against accidental loss or destruction, and that this was a breach of the integrity and confidentiality requirements of Article 5(1)(f) for which DDL retained responsibility by virtue of Article 5(2).
84 I find in addition, on the balance of probabilities, that at the date of the search warrant JPL was storing personal data in a form that permitted identification of data subjects for longer than necessary. This is because the presence of personal data that was two or more years old indicates that not all data was destroyed when it was no longer required. DDL has confirmed that historic, hard copy documents were not required for record keeping purposes. Given the findings I have already made in relation to the provenance of these documents, and the absence of any evidence that the historic records had only been passed to JPL for destruction recently, I am satisfied that the retention of this data by JPL was a breach of the storage limitation requirements of Article 5(1)(e,) for which DDL also retained responsibility by virtue of Article 5(2). I note in addition that, other than Mr Budhdeo's witness testimony, no contemporaneous evidence has been adduced to show when and how JPL securely destroyed personal data on DDL's behalf.
85 I find that DDL's failure to devise adequate data processing policies contributed to JPL's breaches of relevant data processing requirements. In particular, I find that the absence of a retention policy and of a clear explanation by DDL of the processes JPL must follow when destroying personal data incidental to the destruction of medicinal waste must have contributed to JPL's breaches as it was provided with no appropriate procedures to follow.
86 I conclude as a consequence that DDL's responsibility for JPL's breaches also amount to a breach of the requirements of Article 24(1), in that DL failed to implement appropriate and organisational measure to ensure that JPL's processing was performed in accordance with the GDPR, as well as a breach of the requirements of Article 32, in that DDL failed to implement appropriate measure to ensure a level of security appropriate to the risks."
"88 In accordance with the principles identified in Hope and Glory [i.e. R (Hope and Glory) v City of Westminster Magistrates' Court [2011] EWCA Civ 31, [2011] 3 All ER 57] I have afforded appropriate weight to the Commissioner's decision to issue an MPN [i.e. a penalty notice] but note that the level of penalty was predicated upon 500,000 documents having been seized. I have instead considered the appropriate level of penalty based on a finding that 66,638 documents containing personal data were recovered, 53,871 of which contained special category data.
89 I nevertheless reach the same conclusion as the Commissioner, in that the contraventions identified are sufficiently serious to justify issuing a penalty. However, in contrast to the approach taken by the Commissioner in the [Notice], I do not consider a breach of Article 24(1) to be a contravention in relation to which an MPN may be imposed under s. 155(1), because it is not a breach of GDPR listed in s. 149(2).
90 I adopt the Commissioner's assessment of the factors set out in Article 83(2), other than her assessment of the number of data subjects affected by the contraventions which was based on the MHRA's estimated figure of 500,000 documents. I note in particular the Commissioner's conclusions as to the gravity of the breach and the risk of significant emotional distress being caused to a vulnerable group of data subjects were they to become aware of the contraventions. I also agree with the Commissioner's conclusion that the serious breaches of the data processing principles occasioned by JPL's activities were largely due to DDL's negligence in relation to its Article 24(1) and Article 32 obligations.
91 I conclude as a consequence that issuing an MPN is an effective, proportionate and dissuasive response to DDL's contraventions.
92 I note the statutory intention of both the GDPR and DPA is that a higher financial penalty should be imposed under this than other the predecessor legislation. Having considered the Commissioner's statutory guidance and the circumstances of this case, I am satisfied that the Commissioner's penalty assessment in the NOI [i.e. the notice of intent which the Commissioner issued in accordance with paragraph 2 of schedule 16 to the DPA] of £400,000 was appropriate given the facts as she understood them to be. I am further satisfied that her subsequent decision to reduce the penalty to £275,000 was appropriate in light of DDL's financial position.
93 I agree that a person responsible for a serious contravention of the GDPR should not avoid a monetary penalty solely on the basis their financial position, since such a practice would undermine a key purpose of the legislation. However, financial hardship remains an important consideration in terms mitigation. I find that it has already been reflected in an appropriate manner in the MPN under appeal.
94 I am satisfied that the amount of the penalty imposed on DDL should be reduced further in light of the Tribunal's conclusion that substantially fewer than 500,000 documents were recovered. However, 12,491 documents containing personal data and 53,871 documents containing special category data are still very large numbers of documents, and the significant aggravating factor that majority contained the personal data of highly vulnerable data subjects remains.
95 Given the gravity of the contraventions, my additional finding that DDL is responsible for a breach of Article 5(1)(e) obligations, and the long list of aggravating criteria identified in the MPN, I am satisfied that the level of the penalty imposed should not be reduced by a percentage based on solely on the lower numbers of documents.
96 Having taken all of these matters into consideration I have decided that the amount of the [Notice] should be reduced to £92,000, which is a reduction of approximately two thirds."
The legal framework
Obligations of a controller
"1. Personal data shall be:
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ('storage limitation');
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality').
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability')."
"Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary."
Penalty notices
"The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following
(a) a provision of Chapter II of the GDPR [now 'UK GDPR'] or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
(b) a provision of Articles 12 to 22 of the GDPR [now 'UK GDPR'] or Part 3 or 4 of this Act conferring rights on a data subject;
(c) a provision of Articles 25 to 39 of the GDPR [now 'UK GDPR'] or section 64 or 65 of this Act (obligations of controllers and processors) ."
"1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:
(a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;
(b) the intentional or negligent character of the infringement;
(c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;
(d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;
(e) any relevant previous infringements by the controller or processor;
(f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;
(g) the categories of personal data affected by the infringement;
(h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;
(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;
(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and
(k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement."
Appeals
"(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).
(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.
(3) If the Tribunal considers
(a) that the notice or decision against which the appeal is brought is not in accordance with the law, or
(b) to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.
(4) Otherwise, the Tribunal must dismiss the appeal ."
"when taking a fresh decision, the Tribunal is not required to undertake a reasonableness review of the [Commissioner's] decision, but instead must decide whether it would itself reach the same decision based on the evidence now before it".
The Commissioner
"(a) monitor and enforce the application of this Regulation;
(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing ;
(d) promote the awareness of controllers and processors of their obligations under this Regulation;
; and
(v) fulfil any other tasks related to the protection of personal data."
"Step 1. An 'initial element' removing any financial gain from the breach.
Step 2. Adding in an element to censure the breach based on its scale and severity, taking into account the considerations identified at section 155(2)-(4) of the DPA.
Step 3. Adding in an element to reflect any aggravating factors.
Step 4. Adding in an amount for deterrent effect to others.
Step 5. Reducing the amount (save that in the initial element) to reflect any mitigating factors, including ability to pay (financial hardship)."
"Generally", it was said, "the amount will be higher where vulnerable individuals or critical national infrastructure are affected".
The grounds of appeal
i) Judge Macmillan wrongly relegated the "burden of proof" to "secondary importance" and failed to recognise that that burden was on the Commissioner;
ii) Judge Macmillan wrongly afforded weight to the Commissioner's reasons for imposing and setting the penalty when herself deciding whether a penalty should be imposed and, if so, in what sum.
The incidence and significance of the burden of proof
"I conclude that to a limited extent the burden of proof is of secondary importance in the context of a full merits review. However, when the appeal is against a penalty imposed in response to perceived infringements, I am satisfied that there must also be an initial evidential burden imposed upon the decision maker who is required to prove that the infringement has taken place. As a matter of common sense, this evidential burden must shift to the other party once evidence of the infringements has been introduced."
"[70] [T]he general principle, in my view, is that, where a statute gives a right of appeal against enforcement action taken by a public authority, the burden of establishing the grounds of appeal lies on the person appealing.
[71] That principle is well-established in other statutory contexts, particularly where the relevant facts are peculiarly within the knowledge of the person appealing. For example, a local planning authority may serve an enforcement notice if it 'appears' that there has been a breach of planning control. The owner can appeal against the notice on various grounds, which may, for example, include a denial of the acts complained of, or a claim that permission is not required. It has long been clear law that the burden of proof rests on the appellant. That was confirmed recently in this court in Hill v Secretary of State for Transport, Local Government and the Regions [2003] EWCA Civ 1904. Buxton LJ said (at [43][44]):
'[43] The appellant accepted that there is a longstanding decision in planning law, Nelsovil Ltd v Minister of Housing and Local Government [1962] 1 WLR 404, [1962] 1 All ER 423, which has been generally regarded as placing the burden of proof on the appellant in an enforcement notice appeal. That view was developed in the leading judgment of Widgery J and pungently summarised by Slade J at page 409 of the report: "It is a novel proposition to me that an appellant does not have to prove his case."
[44] The general principle that the appellant must prove his case seems to be unassailable '
[72] It is true that both Nelsovil and Hill were planning cases, but the statements in the former were expressed quite generally. There may of course be something in the nature of the appeal, or the statutory context, which requires a different approach .
[73] The ordinary presumption, therefore, is that it is for the appellant to prove his case. That approach seems to me to be the correct starting-point in relation to the other categories of appeals with which we are concerned under s 83 of the 1994 Act, including the appeal against a civil penalty. The burden rests with the appellant except where the statute has expressly or impliedly provided otherwise. Thus, the burden of proof clearly rests on Customs to prove intention to evade VAT and dishonesty. In addition, in most cases proof of intention to evade is likely to depend partly on proof of the fact of evasion, and for that purpose Customs will need to satisfy at least the tribunal that the threshold has been exceeded. But, as to the precise calculation of the amount of tax due, in my view, the burden rests on the appellant for all purposes."
"(i) it is the appellant who knows, or ought to know, the true facts; (ii) s 60(7) makes express provision placing the burden on Customs in relation to specified matters. This suggests that the draftsman saw it as an exception to the ordinary rule, and seems inconsistent with an implied burden on Customs in respect of other matters; (vi) to reverse the burden of proof would make the penalty regime unworkable in many cases. In a case such as the present, a 'best of judgment' assessment is needed precisely because the potential taxpayer has failed to keep proper records, so that positive proof in the sense required in the ordinary civil courts is not possible. The assessment may be no more than an exercise in informed guesswork. Indeed to put the burden on Customs would tend to favour those who have kept no records at all, as against those who have kept records, which are merely inadequate, but may be enough to give rise to an inference on the balance of probabilities."
"It means no more than this, that during the trial of an issue of fact there will often arrive one or more occasions when, if the judge were to take stock of the evidence so far adduced, he would conclude that, if there were to be no more evidence, a particular party would win. It would follow that, if the other party wished to escape defeat, he would have to call sufficient evidence to turn the scale. The identity of the party to whom this applies may change and change again during the hearing and it is often convenient to speak of one party or the other as having the evidentiary burden at a given time. This is, however, no more than shorthand, which should not be allowed to disguise the fact that the burden of proof in the strict sense will remain on the same party throughout, which will almost always mean that the party who relies on a particular fact in support of his case must prove it. I do not see how this fact of forensic life bears on the present case."
Turning to the case before him, Mustill LJ said this at 1059:
"It may well be that, if the taxpayer companies' version does not correspond with the true facts, it must follow that someone was guilty of fraud. This does not mean that, by traversing the taxpayer companies' case, the Revenue have taken on the burden of proving fraud. Naturally, if they produce no cogent evidence or argument to cast doubt on the taxpayer companies' case, the taxpayer companies will have a greater prospect of success. But this has nothing to do with the burden of proof, which remains on the taxpayer companies because it is they who, on the law as it has stood for many years, are charged with the task of falsifying the assessment. The contention that, by traversing the taxpayer companies' version, the Revenue are implicitly setting out to prove a loss by fraud overlooks the fact that, in order to make good their case, the Revenue need only produce a situation where the commissioners are left in doubt. In the world of fact there may be only two possibilities: innocence or fraud. In the world of proof there are three: proof of one or other possibility and a verdict of not proven. The latter will suffice, so far as the Revenue are concerned."
"[48] It is normal for an appellant to have the responsibility of persuading the court that it should reverse the order under appeal, and the [Magistrates' Courts Rules 1981] envisage that this is so in the case of statutory appeals to magistrates' courts from decisions of local authorities. We see no indication that Parliament intended to create an exception in the case of appeals under [the Licensing Act 2003].
[49] We are also impressed by [counsel for the Council's] point that in a case such as this, where the licensing sub-committee has exercised what amounts to a statutory discretion to attach conditions to the licence, it makes good sense that the licensee should have to persuade the magistrates' court that the sub-committee should not have exercised its discretion in the way that it did rather than that the magistrates' court should be required to exercise the discretion afresh on the hearing of the appeal."
"Brady was a case about direct taxation, not VAT, but I can see no reason why the same principles should not apply to a 'best of judgment' assessment to VAT made under s 73 of VATA 1994. The guidance given by Carnwath LJ in the Khan case may have been technically obiter on this point, but he regarded the position on an appeal against such an assessment as 'well-established' and cited Brady with apparent approval. In my respectful view, he was clearly right to do so."
Attaching weight to the Commissioner's reasons
"Given all the variables, the proper conclusion to the first question can only be stated in very general terms. It is right in all cases that the magistrates' court should pay careful attention to the reasons given by the licensing authority for arriving at the decision under appeal, bearing in mind that Parliament has chosen to place responsibility for making such decisions on local authorities. The weight which magistrates should ultimately attach to those reasons must be a matter for their judgment in all the circumstances, taking into account the fullness and clarity of the reasons, the nature of the issues and the evidence given on the appeal."
"The authority [be it, adjudicator, Immigration Appeal Tribunal or immigration judge] will wish to consider and weigh all that tells in favour of the refusal of leave which is challenged, with particular reference to justification under article 8(2). There will, in almost any case, be certain general considerations to bear in mind: the general administrative desirability of applying known rules if a system of immigration control is to be workable, predictable, consistent and fair as between one applicant and another; the damage to good administration and effective control if a system is perceived by applicants internationally to be unduly porous, unpredictable or perfunctory; the need to discourage non-nationals admitted to the country temporarily from believing that they can commit serious crimes and yet be allowed to remain; the need to discourage fraud, deception and deliberate breaches of the law; and so on. In some cases much more particular reasons will be relied on to justify refusal, as in Samaroo v Secretary of State for the Home Department [2002] INLR 55 where attention was paid to the Secretary of State's judgment that deportation was a valuable deterrent to actual or prospective drug traffickers, or R (Farrakhan) v Secretary of State for the Home Department [2002] QB 1391, an article 10 case, in which note was taken of the Home Secretary's judgment that the applicant posed a threat to community relations between Muslims and Jews and a potential threat to public order for that reason. The giving of weight to factors such as these is not, in our opinion, aptly described as deference: it is performance of the ordinary judicial task of weighing up the competing considerations on each side and according appropriate weight to the judgment of a person with responsibility for a given subject matter and access to special sources of knowledge and advice. That is how any rational judicial decision-maker is likely to proceed. It is to be noted that both Samaroo and Farrakhan (cases on which the Secretary of State seeks to place especial reliance as examples of the court attaching very considerable weight to decisions of his taken in an immigration context) were not merely challenges by way of judicial review rather than appeals but cases where Parliament had specifically excluded any right of appeal."
"45. It may be helpful to say more about this point. Where an appellate court or tribunal has to reach its own decision, after hearing evidence, it does not, in general, simply start afresh and disregard the decision under appeal. That was made clear in Sagnata Investments Ltd v Norwich Corpn [1971] 2 QB 614, concerned with an appeal to quarter sessions against a licensing decision taken by a local authority. In a more recent licensing case, R (Hope and Glory Public House Ltd) v City of Westminster Magistrates' Court [2011] PTSR 868, para 45, Toulson LJ put the matter in this way:
'It is right in all cases that the magistrates' court should pay careful attention to the reasons given by the licensing authority for arriving at the decision under appeal, bearing in mind that Parliament has chosen to place responsibility for making such decisions on local authorities. The weight which magistrates should ultimately attach to those reasons must be a matter for their judgment in all the circumstances, taking into account the fullness and clarity of the reasons, the nature of the issues and the evidence given on the appeal.'
46. These observations apply a fortiori to tribunals hearing appeals against deportation decisions. The special feature in that context is that the decision under review has involved the application of rules which have been made by the Secretary of State in the exercise of a responsibility entrusted to her by Parliament, and which Parliament has approved. It is the duty of appellate tribunals, as independent judicial bodies, to make their own assessment of the proportionality of deportation in any particular case on the basis of their own findings as to the facts and their understanding of the relevant law. But, where the Secretary of State has adopted a policy based on a general assessment of proportionality, as in the present case, they should attach considerable weight to that assessment: in particular, that a custodial sentence of four years or more represents such a serious level of offending that the public interest in the offender's deportation almost always outweighs countervailing considerations of private or family life; that great weight should generally be given to the public interest in the deportation of a foreign offender who has received a custodial sentence of more than 12 months; and that, where the circumstances do not fall within paragraphs 399 or 399A [of the Immigration Rules], the public interest in the deportation of such offenders can generally be outweighed only by countervailing factors which are very compelling ."
"It is thus apparent that 'the proper consideration and weight', which the Secretary of State says should be given to any previous decision of the authority, will depend upon the nature of the previous decision in question and its relevance to the issue before the tribunal. The decision of the competent authority under the NRM process was an essentially factual decision and, for the reasons given, both the FTT and the UT were better placed to decide whether MS was the victim of trafficking than was the authority."
Conclusion
Lady Justice Asplin:
Lord Justice Stuart-Smith: