![[2023] UKUT 132 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png){kind=logo}
Ground 4
Ground 4
In my judgment, the simple answer to the Appellant’s law of agency arguments is that the GDPR applies across all Member States of the European Union and, as its recitals show, is intended to secure a consistent level of protection across the Union. For this reason, the GDPR cannot have intended to import the principles of the law of England and Wales governing relationships between a principal and agent. Moreover, I agree with the Commissioner that it not at all clear how the Tribunal might have arrived at a different result had it applied domestic principles of agency law when determining, under the GDPR, the Appellant’s responsibility for data protection breaches occasioned by the acts or omissions of Jogee Pharma. Ground 4 is not made out.
- Heading
- The decision of the Upper Tribunal is to refuse this appeal. The decision of the First-tier Tribunal, taken on 9 August 2021, under file reference EA/2020/0065/V, did not involve an error on a point o
- Meaning of terms used in these reasons
- The main issue of wider interest: summary of conclusion
- Background
- First-tier Tribunal’s decision
- Agreed facts
- Tribunal’s general role
- Burden of proof
- Standard of proof
- Relevance of law of agency
- General conclusions
- Whether a MPN was appropriate
- Penalty amount
- Legislative framework
- Data Protection Act 2018
- giving “careful attention” to the Commissioner’s reasons for imposing the MPN
- Ground 1 - arguments
- there is the potential for significant financial implications, but deprivation of liberty is not an issue
- the Commissioner’s work is clearly very important since he seeks to protect the fundamental rights of data subjects
- Ground 2 – reliance on Hope & Glory
- licensing authority sub-committees are comprised of elected individuals who are answerable to their electors Ground 2 –arguments
- Ground 3 – civil or criminal standard of proof
- Ground 3 – the arguments
- the term “satisfied”, in section 155(1)(a), DPA is relevant to the burden of proof not the standard
- Ground 4 – law of agency
- making a controller legally responsible for the acts of its processor is consistent with an agency relationship; and
- Ground 4 – the arguments
- Ground 5 – Tribunal’s reliance on breach of Article 24(1)
- The arguments
- Ground 6 – considerations relevant to amount of penalty
- rejected the Appellant’s argument that the breach documents originated from care homes when there was no countervailing evidence
- failed to deal with the points made in the Appellant’s skeleton argument at paragraphs 56(5) and (7) to (11)
- The arguments
- paragraph 56 of the skeleton argument . The Tribunal did not disregard the submission that the Commissioner’s finding of careless storage was contradicted by CCTV evidence (see paragraphs 65(xi) and 8
- Ground seven – the arguments
- Conclusions
- Ground 2
- Ground 3
- I do not understand why the ultimate destination of monies paid to satisfy a MPN should be of any relevance to its essential character or why it should tend to show that MPN proceedings have the ‘seri
- Ground 4
- Ground 5
- Ground 6
- Ground 7
- Conclusions