[2023] UKUT 132 (AAC)

Mr Budhdeo was the sole director and shareholder of the Appellant company and Joogee Pharma Ltd;

Joogee Pharma was a licensed waste disposal company;

Mr Budhdeo and his wife jointly owned the Premises, which were used by Joogee Pharma to carry out waste disposal activities on behalf of the Appellant, which included destroying personal data including special category personal data;

Joogee Pharma’s activities constituted data processing for which it was the processor and the Appellant the controller;

the MHRA seized from the Premises at least 73,000 pieces of paper stored in unlocked crates, boxes and bags. Some of the seized documents contained personal data and/or special category personal data;

many of the Appellant’s data protection policies and procedures were out of date at 24 July 2018, and failed to comply with the GDPR. In particular, data subjects were not given the information required by Article 13 and/or 14 of the GDPR;

having been dissatisfied with the Appellant’s response to informal enquiries, on 25 October 2018 the Commissioner issued an Information Notice under section 142(1) of the DPA 2018. The Appellant’s appeal against the Notice was dismissed by the Tribunal and, on 1 March 2019, the Appellant responded in part but relied on privilege against self-incrimination to refuse to respond to certain queries;

on 26 November 2019, the MHRA decided to take no further action against the Appellant under legislation related to the supply of medication, having concluded that there was insufficient evidence to support a reasonable prospect of conviction.