This is the question the Court of Appeal was recently asked to decide after Doorstep Dispensaree Limited (“DD”) appealed against a Monetary Penalty Notice (“MPN”) imposed on it by the Information Commissioner’s Office (“ICO”).

DD argued that:

• The burden of proof lies with the ICO to show a breach of UK GDPR and the ICO should put forward sufficient evidence to the First-tier Tribunal (“FTT”) to discharge that burden; and 
• The FTT should stand in the shoes of the ICO and decide matters afresh; starting with a blank sheet of paper in front of it, rather than using the ICO’s decision as a starting point. 

In its recent judgment, the Court of Appeal rejected both grounds of appeal brought by DD, finding that the burden of proof lies with the appellant, not the ICO. 

The Court of Appeal also found that courts and tribunals are not required to decide matters afresh, rejecting DD’s argument that the FTT should start with a blank sheet of paper to the effect that the tribunal ignores the MPN. 

Background

DD is a retail pharmacy which also supplies medicine to care homes. The Medicines and Healthcare Products Regulatory Agency executed a search warrant in 2018 and informed the ICO that 47 unlocked crates had been recovered from the DD’s yard, all containing personal data relating residents in care homes, comprising names; addresses; NHS numbers; and other medical information. The ICO issued DD a MPN under section 155 of the Data Protection Act 2018 (“DPA”) imposing a fine and an Enforcement Notice. 

Burden of proof

The ICO submitted that: 

• It is a well-established principle that the appellant appealing a regulatory decision bears the burden of proof when they wish to establish additional or different facts; 
• When making a MPN, the ICO must be satisfied with all of the facts which the Commissioner then relies on; and
• It is only where the relevant legislative scheme indicates to the contrary that a different burden of proof is reached, whether that by express words or by implication. 

In its submissions, the ICO added that the burden of proof is “straight forward”. Similar to other regulators, the ICO can issue fines and when doing so, it has to be satisfied with the facts it relies on when making that fine. If the appellant wants to challenge the regulator’s findings, the ICO submitted that it is the appellant who bears the burden of proving the facts it invites the tribunal to find. 

DD argued that the burden lies with the ICO to show a breach of UK GDPR, and that the ICO should put forward sufficient evidence to discharge that burden. Any evidence the appellant produces then needs to be weighed up by the FTT before it can make an evaluative decision. 

DD summarised the ICO’s position by stating that because there is nothing in the UK GDPR or DPA that disapplies the general rule of the appellant bearing the burden of proof, then the ICO does not have to show or prove any factual matters before the FTT. 

Starting with the MPN or a blank sheet of paper?

DD argued that in deciding whether to uphold the MPN or not, the FTT must start with a blank sheet of paper, not the penalty notice itself. It should then decide whether there has been non-compliance with the GDPR and the DPA, and decide for itself whether it is right to issue a penalty notice, and what the level of that notice should be. 

The ICO disagreed with DD that the FTT must start with a “blank sheet of paper” when considering an appeal against the regulator’s fine. Citing section 162 and 163 of the DPA, the ICO said it was clear that the starting point is the MPN itself, noting that the FTT must “consider the notice” against which the appeal is brought to determine whether it was made in accordance with the law or whether the Commissioner exercised its discretion properly when issuing the fine. 

The ICO added it was “essential” to any analysis by the FTT that the reasons given by the Commissioner for exercising the discretion to issue a fine must be considered, and the Court of Appeal agreed. The key takeaway to this case is to reassure regulators that in any statutory appeal taken against their enforcement action, the burden of establishing the grounds of appeal lies firmly with the appellant. Our public law team have expertise across all stages of a regulatory challenge acting for both regulatory bodies and appellants and are on hand to assist at any stage in the process. 

Written by

Related News, Insights & Events