Doorstep Dispensaree Ltd v The Information Commissioner

Factual and Procedural Background

The appeal concerns a penalty imposed by the Information Commissioner ("the Commissioner") on a pharmacy, referred to as the Appellant, for breaches of the Data Protection Act 2018 ("the DPA") and the UK GDPR. The Appellant operated both an internet-based pharmacy and a retail pharmacy and engaged a licensed waste disposal company ("Company B") to handle destruction of personal data generated in its business. A search warrant executed by a regulatory authority at a property owned by the Appellant's director and his spouse uncovered a large volume of documents containing personal and special category data, some stored insecurely and in poor condition.

The Commissioner issued a penalty notice of £275,000, reduced from an initial notice of intent of £400,000, citing serious contraventions including failure to implement appropriate organisational and security measures and failure to provide required information to data subjects. The Appellant appealed to the First-tier Tribunal (General Regulatory Chamber) ("the FTT"), which held a two-day hearing and subsequently reduced the penalty to £92,000. The Appellant then appealed unsuccessfully to the Upper Tribunal and now challenges that decision in the Court of Appeal. The appeal focuses on the burden of proof in such appeals and the extent to which the FTT may give weight to the Commissioner's views expressed in the penalty notice.

Legal Issues Presented

1. Where does the burden of proof lie when a person appeals against a penalty imposed by the Commissioner under section 155 of the Data Protection Act 2018?
2. Whether the First-tier Tribunal can properly attach weight to the views expressed by the Commissioner in the penalty notice when determining such an appeal.

Arguments of the Parties

Appellant's Arguments

• The burden of proof lies on the Commissioner to satisfy the tribunal that the Appellant failed as described in section 149(2) of the DPA and that it is appropriate to impose a penalty.
• The FTT should not attach weight to the Commissioner's reasons for imposing and setting the penalty, as doing so creates an unfair predisposition to uphold the penalty and conflicts with the tribunal's independent role.
• The Commissioner, being unelected and subject to statutory guidelines, should not be afforded the same deference as decision-makers in other contexts such as local authorities or immigration ministers.

Court's Considerations on Arguments

The court considered the Appellant's contentions but ultimately rejected them, affirming that the burden of proof lies on the appellant in such appeals and that it can be proper for the FTT to give some weight to the Commissioner's views expressed in penalty notices, given the Commissioner's statutory role and expertise.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Khan v Customs and Excise Commissioners [2006] EWCA Civ 89	Burden of proof in appeals against enforcement actions lies on the appellant unless statute provides otherwise.	Affirmed that the burden of proof in appeals against penalty notices under the DPA lies on the appellant.
Brady (Inspector of Taxes) v Group Lotus Car Companies plc [1987] 3 All ER 1050	Burden of proof on appeals against "best of judgment" assessments remains with the appellant, even where fraud is alleged.	Supported the principle that the evidential burden may shift during proceedings but the overall burden remains on the appellant.
R (Hope and Glory) v City of Westminster Magistrates' Court [2011] EWCA Civ 31	Appellate tribunal should pay careful attention to reasons given by the original decision-maker but weigh them independently.	Guided the court's approach to how much weight the FTT may give to the Commissioner's penalty notice.
Central London Community Healthcare NHS Trust v Information Commissioner [2013] UKUT 551 (AAC)	Appeals under the DPA involve a full merits review with no evidential head start for either party.	Supported the understanding of the tribunal's role in conducting a fresh review of the evidence.
Huang v Home Secretary [2007] UKHL 11	Appellate tribunal must decide for itself but may give appropriate weight to the primary decision-maker's judgment.	Informed the court's view that the FTT may properly attach weight to the Commissioner's views given their expertise.
Hesham Ali v Home Secretary [2016] UKSC 60	Appellate tribunals should attach considerable weight to decisions made by primary decision-makers entrusted by Parliament.	Supported the principle of giving weight to the Commissioner's penalty decisions in appeals.
MS (Pakistan) v Home Secretary [2020] UKSC 9	Tribunal must determine facts afresh but give proper consideration and weight to previous decisions of competent authorities.	Reinforced the approach to weighing prior decisions in appellate determinations.
Awards Drinks Ltd v Revenue and Customs Commissioners [2021] EWCA Civ 1235	Burden of proof principles from Brady and Khan apply to "best of judgment" VAT assessments.	Confirmed the consistency of burden of proof principles in tax and penalty appeals.

Court's Reasoning and Analysis

The court analysed the burden of proof issue by reference to established authorities in tax and regulatory penalty appeals. It concluded that the general principle is that the burden of proof lies on the appellant to establish that the penalty should not stand, unless the statute explicitly provides otherwise. The court found no such provision in the DPA, and emphasised that the appellant is best placed to know the true facts regarding the alleged breaches.

The court also explained that the FTT's role in a full merits review is compatible with the appellant bearing the burden of proof, as the tribunal independently assesses all evidence without deference but still applies the civil standard of proof.

Regarding the weight to be given to the Commissioner's views expressed in the penalty notice, the court examined analogous case law from licensing and immigration appeals. It held that while the tribunal must decide independently, it can properly give weight to the Commissioner's reasoned views due to the Commissioner's statutory role, expertise, and access to information. This is especially relevant when considering penalty amounts and the proportionality, deterrence, and aggravating factors involved.

The court found no error in the FTT's approach, noting that the tribunal did not uncritically endorse the Commissioner's reasoning but adopted those aspects it found persuasive. The tribunal's findings on breaches and penalty reduction were based on evidence and its own assessment, not merely on the Commissioner's views.

Holding and Implications

The court DISMISSED the appeal.

The holding confirms that in appeals against penalty notices under the Data Protection Act 2018, the burden of proof lies on the appellant to demonstrate that the penalty is unjustified. Additionally, the First-tier Tribunal may lawfully attach weight to the Commissioner's views expressed in penalty notices when assessing the appropriateness and amount of penalties, provided it retains an independent and critical evaluative role. This decision clarifies the procedural and substantive standards applicable in such appeals but does not establish new legal principles beyond reaffirming existing authorities and applying them to the data protection penalty context.