[2023] UKUT 132 (AAC)

The DPA 2018 seeks to implement the GDPR and many of its provisions operate by reference to the GDPR.

Section 155(1) permits the Commissioner to give a penalty notice (MPN) requiring a person to pay to the Commissioner the amount specified “if…satisfied that a person (a) has failed or is failing as described in section 149(2)”. Schedule 16(2) requires the Commissioner to give a ‘notice of intent’ before issuing a MPN.

Section 149(2) includes the following failures (which are also grounds for giving an Enforcement Notice under section 149(1)):

“(2)

The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following –

(a)

a provision of Chapter II of the GDPR [Articles 5 to 11]…

(b)

a provision of Articles 12 to 22 of the GDPR…;

(c)

a provision of Articles 25 to 39 of the GDPR…”

To the extent that a MPN concerns a matter to which the GPDR applies, the Commissioner must, in deciding whether to give a MPN and in determining the penalty amount, have regard to “the matters listed in Article 83(1) and 2 of the GDPR” (section 155(2)). For GDPR infringements, the maximum amount of the penalty is that specified in Article 83 of the GDPR. In other cases, the “standard maximum amount”, in section 157(6), closely resembles the maximum administrative fine provisions of Article 83.

Section 160(1) requires the Commissioner to produce and publish guidance about how he proposes to exercise functions in connection with penalty notices (amongst other matters). The guidance must include provision about the circumstances in which the Commissioner would consider it appropriate to give a MPN and an explanation of how penalty amounts will be determined (section 160(7)).

If a penalty is not duly paid, it is recoverable in England and Wales as if payable under an order of the county court or High Court, if the court so orders (paragraph 9(2) of Schedule 16).

Section 162(1) allows a person given a MPN to appeal to the First-tier Tribunal. A person may appeal against the amount of a penalty without appealing against the MPN (section 162(3)).

On appeal, the Tribunal may “review any determination of fact on which the notice or decision against which the appeal is brought was based” (section 163(2)). If the Tribunal considers that the penalty notice is not in accordance with the law or the Commissioner ought to have exercised any discretion differently, the Tribunal “must allow the appeal or substitute another notice…which the Commissioner could have given…”.

An onward right of appeal to the Upper Tribunal against the First-tier Tribunal’s decision lies on “any point of law arising from” the decision (section 11(1) of the Tribunals, Courts and Enforcement Act 2007).

The First-tier Tribunal granted the Appellant permission to appeal to the Upper Tribunal on all seven grounds put to that tribunal.

This ground is that the Tribunal conducted the Appellant’s appeal “on a legally flawed basis and in a legally flawed way” by: