Clifford Chance

The Court of Appeal judgment in Doorstep Dispensaree Limited v The Information Commissioner, handed down in December 2024, confirms, in relation to appeals of monetary penalty notices for breaches of data protection law, that (1) when relevant to determining whether a monetary penalty notice was justified, the burden of proof is on the party appealing, and (2) the First-Tier Tribunal may attach weight to the reasons given by the Information Commissioner for reaching a decision when they are relevant to matters of discretion, such as the proportionality and effectiveness of a penalty or the gravity of a GDPR breach.

BACKGROUND

In 2019, Doorstep Dispensaree Limited (DDL) received the first ever monetary penalty notice(MPN) issued by the UK Information Commissioner (the Commissioner) under the EU General Data Protection Regulation (GDPR)* and Data Protection Act 2018 (UK DPA). DDL appealed the penalty on various grounds, reduced to two when the case reached the Court of Appeal in November 2024. DDL was granted permission to appeal on the grounds that, when the First-Tier Tribunal (FTT) heard DDL’s initial appeal, it should:

• have proceeded on the basis that the burden of proof was on the Commissioner to justify the imposition and amount of the penalty ("Ground 1"); and
• not attach any weight to the reasons given by the Commissioner in the monetary penalty notice for imposing and assessing the amount of the penalty ("Ground 2").

The Court of Appeal handed down its judgment on 9 December 2024, dismissing both grounds of appeal.

*The GDPR has subsequently been implemented into UK domestic law, post-Brexit, but without any change relevant to the Court of Appeal’s decision in this case.

FACTS

DDL is a pharmacy which provides medication to patients in care homes. The sole shareholder and director of DDL, Mr Budhdeo, was also the sole director and shareholder of Joogee Pharma Limited (JPL), a waste disposal company. JPL carried out waste disposal activities on behalf of DDL.  

On 24 July 2018, the Medicines and Healthcare Products Regulatory Agency (MHRA) executed a search warrant at premises in Harrow owned by Mr Budhdeo and his wife and used by JPL. The MHRA seized unlocked crates, boxes and bags of documents. According to DDL's solicitor, there were 73,719 documents in the various containers, 53,871 of which included special category data relating to health.

The Commissioner served notice on DDL of an intention to impose an MPN of £400,000. On 17 December 2019, following representations regarding DDL's finances, a reduced penalty of £275,000 was imposed in the MPN for numerous "extremely serious" breaches of the GDPR, particularly with regard to over-retention and lack of appropriate security measures, which demonstrated "a cavalier attitude to data protection".

BACKGROUND TO THE APPEAL

DDL appealed the MPN to the FTT under s. 163 of the UK DPA. The FTT allowed the appeal in part, lowering the penalty from £275,000 to £92,000 (the FTT Decision), because the MPN was predicated on the MHRA's estimation that 500,000 documents had been seized, when in reality the figure was substantially lower.

DDL further appealed the MPN to the Upper Tribunal (Administrative Appeals Chamber). The Upper Tribunal dismissed the appeal, which DDL challenged. The Court of Appeal handed down judgment on 9 December 2024.

It was common ground between the parties that a s. 163 appeal provides for a "full merits" review of the decision to impose an MPN. As noted at paragraph 36 of the FTT Decision, “when taking a fresh decision, the Tribunal is not required to undertake a reasonableness review of the [Commissioner’s] decision, but instead must decide whether it would itself reach the same decision based on the evidence now before it”.

GROUND 1 - BURDEN OF PROOF

In the FTT Decision, Judge Macmillan made findings and did not rely on a particular party bearing the burden of proof (¶43). She concluded "that to a limited extent the burden of proof is of secondary importance in the context of a full merits review." Counsel for DDL argued that, instead, the burden fell on the Commissioner to satisfy the FTT that DDL had failed to comply with the GDPR and that it was appropriate for her to impose a penalty, if any (¶30).

Counsel for DDL argued that, although the UK DPA does not expressly provide for the burden of proof to fall on the Commissioner, it does so impliedly. Counsel submitted that there was a distinction between a case in which the refusal of a benefit is being challenged (such as in R (Hope and Glory) v City of Westminster Magistrates’ Court [2011] EWCA Civ 31, [2011] 3 All ER 579) where the burden is on the appellant, and one in which the imposition of a penalty is being challenged (as in the current case), where the burden should be on the agency imposing the penalty (¶38).

The Court of Appeal disagreed with DDL's submissions, finding that "the burden of proof on an appeal against a penalty notice is throughout on the appellant" (¶41). It cited, among others, the case of Khan v Customs and Excise Commissioners [2006] EWCA Civ 89, [2006] STC 1167. This case concerned Customs and Excise's decision to impose a penalty for VAT evasion on an individual business owner. In that case, Carnwath LJ said that the “general principle, in my view, is that, where a statute gives a right of appeal against enforcement action taken by a public authority, the burden of establishing the grounds of appeal lies on the person appealing” (¶70), "…except where the statute has expressly or impliedly provided otherwise” (¶73).

Newey LJ concluded that the DPA does not, as counsel for DDL submitted, impliedly provide otherwise. He held that "the FTT will normally be able to decide whether a penalty is justified without resort to the burden of proof. Where, however, that is not the case, the burden is on the appellant, not (contrary to DDL’s contention) the Commissioner" (¶42).

The first ground of appeal therefore failed.

GROUND 2 - WEIGHT ATTACHED TO THE COMMISSIONER'S REASON

In the FTT Decision, Judge Macmillan said that, “[i]n accordance with the principles identified in Hope and Glory”, she had “afforded appropriate weight to the Commissioner’s decision to issue [a penalty notice]”. Toulson LJ in Hope and Glory had concluded that "careful attention" should be paid to the reasons given by the licence authority for the decision under appeal, while the extent of weight afforded should take into account all the circumstances (¶45).

Counsel for DDL submitted that Judge Macmillan was wrong to attach any weight to the Commissioner's reasons and that by paying "careful attention" to them, the FTT was starting from a predisposition to uphold the Commissioner's decision (¶46).

Aside from Hope and Glory, the Court of Appeal reviewed a number of cases, all immigration related, where weight was appropriately attached to the views of the original decision-maker. Counsel for DDL sought to distinguish these cases from the case before the Court by emphasising that these cases were on policy-focused decisions made by a Minister who can be held to account by the electorate and Parliament, and Hope and Glory was a decision by councilors accountable to their constituents (¶53). Counsel argued that the Commissioner is in not in a position of equivalent accountability, and that the FTT should therefore not attach any weight to views set out in it (¶53).

Newey LJ agreed that, in deciding whether a person has failed to comply with the GDPR, "[t]o the extent that the point turned on the facts, the FTT would have to make up its own mind on the basis of the evidence before it. Nor could an argument as to the law gain any extra weight because it had been incorporated in the penalty notice" (¶56). However, he found that this changes when the FTT is deciding whether to impose a penalty, and if so for how much. He stated that "[i]n that context, it seems to me that it can sometimes be proper for the FTT to attach weight to the fact that something said in a penalty notice was informed by the knowledge and expertise of an individual to whom Parliament has given functions and responsibilities as regards data protection" (¶57). The contents of the MPN are relevant to the exercise of discretion on issues such as penalties being "effective, proportionate and dissuasive" (Article 83(1) GDPR) and taking into account "the nature, gravity and duration of the infringement (Article 83(2) GDPR).

The FTT correctly gave no weight to the contents of the MPN when concluding that DDL had failed to comply with the GDPR, instead, as it was entitled to do, it "afforded [them] appropriate weight" when determining what (if any) penalty it imposed (¶58).

The second ground of appeal therefore also failed.

COMMENTS

The Court of Appeal's judgment  confirms that when appealing MPNs imposed by the Commissioner, the burden will rest on the appellant throughout.

Furthermore, the FTT may attach weight to the reasons given by the Commissioner for reaching a decision when they are relevant to matters of discretion, such as the proportionality and effectiveness of a penalty or the gravity of a GDPR breach, although it should make up its own mind, attaching no particular weight to the Commissioner's views, on questions of fact and law.

John Edwards, the current Commissioner, stated “I welcome the Court of Appeal’s judgment in this case as it provides clarity for future appeals. We defended our position robustly and are pleased that the Court has agreed with our findings.”