[2023] UKUT 132 (AAC)

The Appellant company operated pharmacies and much of its business involved supplying medicines to care homes. In July 2018, the Appellant held dispensing contracts with 27 care homes.

The Appellant’s sole director and shareholder was Mr S Budhdeo. He was also the sole director and shareholder of Joogee Pharma Ltd, a company engaged by the Appellant to collect from care homes, and dispose of, unused medicines and pharmaceutical records. According to Mr Budhdeo’s evidence before the Tribunal, Jogee Pharma had been providing services to the Appellant since March 2018, but that arrangement was not, at July 2018, governed by any written contract.

On 24 July 2018, the Medicines and Healthcare Products Regulatory Agency (MHRA) executed a search warrant at 75-79 Masons Avenue, Harrow (“the Premises”). Joogee Pharma used the Premises in their business operations. The Commissioner was not present at, nor did he have prior knowledge of, the search.

The Premises included an outside yard which, according to Mr Budhdeo’s evidence before the Tribunal, could be accessed from the fire escapes of adjacent residential flats. The MHRA reported seizing from the yard 47 unlocked crates, two disposal bags and a cardboard box, which contained pharmaceutical and related documents.

Following the MHRA’s search, they informed the Commissioner’s office of the documents seized. The Commissioner’s staff relied on MHRA’s audit of the documentation to determine its contents. The audit stated that some 500,000 documents, dated from December 2016 to June 2018, were seized at the Premises comprised of the following:

The MHRA thought that many of the documents contained personal data and special category personal data, mainly relating to care home residents. The MHRA also reported that many documents were “soaking wet”, which they thought consistent with storage outdoors.

Acting under Schedule 16 to the DPA 2018, the Commissioner served on the Appellant notice of intention to impose a MPN in the sum of £400,000. Having received representations about the Appellant’s finances, the MPN issued on 17 December 2019 imposed a reduced penalty of £275,000. At the same time, the Commissioner issued the Appellant with an Enforcement Notice under section 149(1) of the DPA 2018.

In January and July 2020, the Appellant’s solicitor carried out what was subsequently described by the Tribunal as a “more detailed analysis of the documents”. The solicitor concluded that no more than 75,000 documents were seized of which 7,351 contained no personal data, 6229 contained only a name, 6,268 contained only a name and address, and 53,871 contained special category personal data. The solicitor also reported that three crates and bags contained damp and mouldy documents.