[2023] UKUT 132 (AAC)

By the date of the hearing before myself, the ground 3 issues had been clarified. The Appellant’s case is that domestic law authorities, that is authorities other than those under Article 6 of the European Convention on Human Rights, compel the criminal standard of proof in MPN tribunal proceedings. If the Appellant is wrong about that, its alternative argument is that MPN proceedings involve the determination of a criminal charge for the purposes of Article 6 and, for that reason, the criminal standard of proof is required. There are some spin-off arguments as well, but the main thrust of the Ground 3 arguments is as just described.

In Re B (children) (sexual abuse: standard of proof) [2008] UKHL 35, Lord Hoffman identified, at [5] a category of case which, while determined in proceedings classified as civil, “nevertheless…because of the serious consequences of the proceedings, the criminal standard of proof or something like it should be applied”. The Appellant argues that MPN proceedings have such serious consequences and, accordingly, the criminal standard of proof applies.

The Appellant argues that “the attributes and consequences of a monetary penalty are overwhelmingly consistent with it being a penal sanction” under domestic law so that, on a MPN appeal, disputed matters of fact are to be resolved according to the criminal standard of proof. The ‘attributes and consequences’ which demonstrate that the MPN is essentially a punitive measure are as follows

the immediate concern of a MPN is not compliance or enforcement, rather it is punishment for failing to comply with data protection requirements and this is shown by the terms of section 155(3), DPA 2018;

the MPN’s punitive character is underscored by comparison with the Commissioner’s other tools under the DPA 2018 for responding to non-compliance with data protection requirements. Information, Assessment and Enforcement Notices are all directed at coercing compliance. A MPN, however, may be given under section 155(1)(b), DPA 2018 where a person fails to comply with one of these coercive notices. In this respect, the MPN is indistinguishable in outcome from a fine for non-compliance with an enforcement notice under other regulatory regimes, such as planning. In those cases, the fine is an undeniably penal sanction imposed at the end of a criminal process;

the amount of the penalty is “set by reference to criteria that mimic the criteria applied by criminal courts on conviction for offences”. The criteria provided for by section 155(2) and (3), DPA 2018, resemble those under sections 63, 65, 73, 74, 124 and 125 of the Sentencing Act 2020 as well as the Sentencing Council’s guidelines for various regulatory offences. Unlike other statutory penalties, such as tax-related penalties, the amount is not set by reference to the financial benefits of non-compliance;

the maximum penalty is consistent with a punitive regime. The maxima under section 157, DPA 2018, and Article 83 of the GDPR cannot be compared with other penalty regimes, for example those under tax legislation. In this respect, MPNs are in a class of their own. The maximum penalty amounts are not theoretical. At the hearing, Mr Coppel informed me that, to his knowledge, the Commissioner has issued numerous Notices of Intent to impose penalties of “tens of millions of pounds” and, in one case, more than £100 million (Mr Coppel conceded that, in most of these cases, the final penalty was significantly reduced). The potential penalties are quite sufficient to put an end to a business and, in turn, employees’ livelihoods. The Commissioner reliance on the GDPR’s reference to administrative fines as “dissuasive” is misplaced. Given the enormous penalties that may be imposed, even if a MPN is dissuasive in effect, it is also punitive. Seriousness must be evaluated according to the penalty that could be imposed because there clearly cannot be different standards of proof for proceedings concerned with a single type of penalty.;

a MPN does not affect a data subject’s right to compensation for material and non-material damage resulting from non-compliance with data protection requirements (see sections 168 and 169, DPA 2018). It follows that the purpose of a MPN is punitive;

where a penalty is paid, the ultimate destination of the monies is the Consolidated Revenue (Schedule 12(1) to DPA 2018). The sums are used neither to compensate a data subject nor defray administrative enforcement costs;

by paragraph 9(2) of Schedule 16 to DPA 2018, enforcement of a MPN utilises the same procedure as applies to payment of a fine imposed by a Magistrates’ Court (see Magistrates’ Court Act 1980, section 87(1)).

held, at [39], that “the application of the civil standard to penalty proceedings of the nature at issue in the appeal was in accordance with domestic law”;

observed, at [181], that it does not necessarily follow “that in all cases where an allegation is serious and has serious consequences for an individual that the allegation must be proved on the criminal standard”;

observed, at [191], that the fact that a substantial financial penalty may result does not in itself amount to the serious consequences necessary to bring a case within the category identified by Lord Hoffman.

neither the forum in which the appeal was conducted nor provisions of the DPA 2018 allowing for criminal prosecutions by the DPP and Commissioner sheds light on the standard of proof;