The Court of Appeal (CoA) was asked to clarify the approach to penalty appeals under the Data Protection Act (DPA) 2018 and where the burden of proof lies.
Background:
Doorstep Dispensaree Limited (DDL) is a pharmacy whose main source of business is dispensing medication to patients in care homes. At the material time, it operated both a "closed", internet-based pharmacy (which received prescriptions from nursing homes and GP surgeries directly) and a retail pharmacy in Cambridge. The sole shareholder and director is Mr. Sanjay Budhdeo.
Mr Budhdeo and his wife own a property at 75-79 Masons Avenue where another company, Joogee Pharma Ltd., also owned by Mr. Budhdeo, conducts its activities on behalf of Doorstep Dispensaree Ltd.
On the 24th of July 2018, the Medicines and Healthcare Products Regulatory Authority ("the MHRA") executed a search warrant at the property. It seized unlocked crates, boxes and bags of documents. A total haul of 53,871 documents was seized, including special category data relating to health, while a further 12,497 documents included other personal data.
On the 17th of December 2019, the Commissioner issued a notice imposing a penalty of £275,000 on DDL pursuant to Section 155 of the DPA 2018. The notice made clear that the breaches were "extremely serious" and demonstrated "a cavalier attitude to data protection". DDL appealed to the First-tier Tribunal (FTT) which reduced the amount to £92,000. DDL unsuccessfully appealed to the Upper Tribunal (UT) and then to the CoA.
Decision:
The CoA dismissed the appeal. The Court first noted that the initial burden of proof is on the Commissioner to establish that an infringement occurred. Subsequently, however, the burden of proof shifts to the appellant who must persuade the FTT that the penalty should not stand under Section 163 of the DPA 2018. This conclusion is based on common sense once evidence of the infringements has been given. For the purposes of the DPA, DDL was the data controller.
The Court also noted that, while the FTT may consider the Commissioner’s views as expressed in the penalty notice, it must exercise caution in attributing excessive weight to them. However, the FTT should make its own findings of primary fact.
Implications:
This judgement clarifies the burden of proof on appeal and the fact that it lies with the appellant. While the question of burden of proof can be regarded as secondary, when the infringement is proven and the Commissioner issues a penalty notice, then the burden shifts to the appellant as a matter of common sense. This means that, before challenging a notice, it is important to have sufficient evidence to demonstrate that the infringement did not occur.
Courts are not required to look at the appeal with a ‘blank sheet of paper’ and should consider the penalty notice while not placing excessive weight on it. This ruling also means that courts and tribunals could use facts mentioned in the penalty notice to help them reach their judgements.