First-tier Tribunal reduces DPA 2018 monetary penalty by 2/3rds
Doorstep Dispensaree Ltd v Information Commissioner
Tribunal Judge Moira MacMillan, First-tier Tribunal
Decision date: 18 August 2021
By a monetary penalty notice under s 155 of the Data Protection Act 2018 the ICO imposed a £275,000 fine on a pharmacy that supplied medicine to care homes together with an enforcement notice. The pharmacy appealed to the FTT. The FTT reduced the penalty to £92,000 and upheld the EN.
Headline points from the Tribunal’s decision:
1. An appeal to the FTT against an MPN is a full merit review, ie the FTT is not limited to considering whether the ICO’s decision was reasonable: the FTT decides whether it would come to the same decision based on the evidence produced to the FTT [36].
2. Where an appellant appeals against an MPN, there is an initial evidential burden on the ICO to prove that an infringement has taken place [38].
3. The FTT has competency to decide its own jurisdiction [46].
4. The civil standard of proof applies to an appeal against an MPN [47].
5. Principles of agency do not shed light on the relationship of controller and processor [54].
6. A controller’s responsibility for a processor’s breach of GDPR Arts 25 (organisational measures) and 32 (data security) will extend to where the processor has processed otherwise than in accordance with the controller’s instructions [83]-[86].
The FTT decision is available here.
Counsel for Doorstep Dispensaree Ltd: Philip Coppel QC, Cornerstone Barristers
Counsel for ICO: Peter Lockley, 11KBW
