Doorstep Dispensaree Ltd v The Information Commissioner

Factual and Procedural Background

This appeal concerns an Information Notice served by the Information Commissioner on the Appellant company on 25 October 2018. The Commissioner’s power to serve such a notice and the right of appeal to the Tribunal were introduced by the Data Protection Act 2018 (DPA 2018). The Information Commissioner was investigating the Appellant’s compliance with the General Data Protection Regulation (GDPR) following a report from the Medicines and Healthcare Products Regulatory Agency (MHRA) regarding the Appellant’s processing of personal data. The Commissioner requested information from the Appellant, who refused to provide it, prompting the Commissioner to serve the Information Notice. The Appellant appealed, which suspended the obligation to comply with the Notice pending the appeal’s determination. The Tribunal also considered a preliminary issue regarding whether the Notice was invalid if compliance risked self-incrimination, concluding it was not invalid on that basis. Ultimately, the Tribunal dismissed the appeal.

Legal Issues Presented

1. Whether the Information Notice served by the Information Commissioner was invalid on the basis that complying with it would risk self-incrimination of the Appellant.
2. Whether the Information Notice was in accordance with the law under the Data Protection Act 2018, including compliance with procedural requirements.
3. Whether the Tribunal should exercise its discretion to amend the Information Notice to remove questions that might compel self-incrimination.

Arguments of the Parties

Appellant's Arguments

• The Appellant argued that because there was a criminal investigation by MHRA, the proper way to question the company was through criminal proceedings under the Police and Criminal Evidence Act, and not via an Information Notice under the Data Protection Act, to avoid contravening the criminal code and Human Rights Act.
• The Appellant contended that the Information Commissioner was effectively assisting the MHRA’s criminal investigation without due process by requesting information under the guise of data protection legislation.
• The Appellant claimed non-disclosure by the Commissioner regarding the root of MHRA’s concerns despite requests for such disclosure.
• At the hearing, the Appellant refined its case, submitting that the Information Notice was void for breaching section 143(6) DPA 2018, which protects against self-incrimination, arguing that the Commissioner should not compel answers that could be used in criminal proceedings.
• Alternatively, the Appellant requested that the Tribunal amend the Notice to remove certain questions (questions 2, 3, 6, and 7) that would compel self-incrimination.
• The Appellant did not pursue arguments regarding the need for disclosure or compliance with the Police and Criminal Evidence Act at the hearing.

Commissioner's Arguments

• The Commissioner distinguished her GDPR investigation from the MHRA’s criminal investigation, emphasizing that her role is limited to enforcing GDPR compliance.
• The Commissioner argued that there is no requirement for her to provide disclosure before requiring answers to an Information Notice.
• She submitted that the safeguards against self-incrimination under section 143(6) DPA 2018 apply to the Appellant’s obligation to comply with the Notice, but do not invalidate the Notice itself.
• The Commissioner maintained that the Notice was lawful and that the Tribunal should dismiss the appeal, as there was no evidence to justify altering the Commissioner’s discretion in serving the Notice.
• The Commissioner sought expedition of the appeal to progress the investigation.

Table of Precedents Cited

No precedents were cited in the provided opinion.

Court's Reasoning and Analysis

The Tribunal analyzed the statutory framework under the Data Protection Act 2018, particularly sections 142 and 143, which govern the issuance of Information Notices and restrictions relating to self-incrimination. The Tribunal concluded that while section 143(6) protects a person from being compelled to provide information that would expose them to criminal proceedings, this protection does not render an Information Notice invalid if served. Instead, the recipient may raise the risk of self-incrimination with the Commissioner who must then consider whether to enforce, cancel, or amend the Notice through court proceedings. The Tribunal found that the Appellant had provided limited information about the scope of the criminal investigation and the risk of self-incrimination. However, the concerns raised by the MHRA justified the Commissioner’s investigation and the request for information. The Tribunal held that the Information Notice complied with legal requirements and that there was no basis to find that the Commissioner should have exercised her discretion differently. Although the Tribunal noted procedural improvements that could be made—such as expressly informing recipients about section 143 protections—the Notice was lawful and enforceable.

Holding and Implications

The Tribunal’s final decision was to DISMISS THE APPEAL.

This means the Appellant remains obligated to comply with the Information Notice unless and until the Commissioner decides otherwise or enforcement proceedings are initiated. The decision confirms that an Information Notice is not invalidated solely because compliance may risk self-incrimination; instead, statutory safeguards allow the recipient to raise such concerns with the Commissioner. The Tribunal did not establish new precedent but clarified the application of the self-incrimination protection under the Data Protection Act 2018 in the context of Information Notices.