[2023] UKUT 132 (AAC)

The Appellant submits that, before the Tribunal, the relationship between itself and Jogee Pharma was of central importance. The Appellant argued that the GDPR’s description of the relationship between a controller and a processor fitted perfectly the generally accepted definition of an agency relationship with the controller as principal and the processor as agent. Jogee Pharma, in its guise as the Appellant’s processor, had arrogated responsibility for determining the purposes and means of processing, in breach of Article 28 of the GDPR. That breach exposed the processor (Jogee Pharma) to an administrative fine (Article 83(1) of the GDPR). Unless the Appellant, as controller, connived in this arrogation of responsibility, or failed to implement the technical and organisational measures required by Articles 25 and 32 of the GDPR, the Appellant was not responsible for processing whose purposes and means were determined by the processor alone. The law of agency shed valuable light on the question whether Jogee Pharma had arrogated to itself responsibility for determining the purposes and means of processing.

The Appellant argues that the Tribunal showed ‘no interest’ in its agency arguments, briefly dismissing them on the ground that it was ‘not persuaded’ that the law of agency shed light on the extent to which the Appellant was controller of the data recovered and its responsibility for Jogee Pharma’s breaches. The Tribunal’s reasons exhibited little understanding of the law of agency, and it overlooked that it was no coincidence that the GDPR described the controller-processor relationship using the well-recognised language of an agency relationship, i.e. one legal person acting on behalf of another legal person.

At the hearing of this appeal, Mr Coppel submitted that, before the Tribunal, the Appellant’s agency arguments were connected to the Commissioner’s factual mistake concerning ownership of the premises. The Commissioner found that the premises were owned by the Appellant but that was wrong; they were owned by Mr Budhdeo. Under domestic agency law principles, if a principal allows an agent to use its premises, the acts of the agent are those of the principal but that is not necessarily the case where premises are not owned by a principal. This is why the Appellant’s agency law submissions to the Tribunal were important. Mr Lockley argued that, if the Commissioner made a mistake of fact, it was corrected by the Tribunal (see paragraphs 53(iv) and 65(ix) of the Tribunal’s reasons. Any distinction regarding ownership of the Premises was illusory and not material to the Tribunal’s decision.

The Commissioner argues that the existence of a controller-processor relationship is determined by reference to the provisions of the GDPR, in particular Articles 4(7) and (8). While it might resemble a principal-agent relationship, the concepts are not equivalent and it would have been simply a distraction for the Tribunal to have applied domestic agency law principles. Moreover, it is wholly unclear how the Appellant’s case would have been helped by applying principles of agency law. The argument that the Tribunal erred in law by ‘refusing to allow itself to be informed’ by agency law fails to identify any specific error of substance. Ground 4 is another legal point raised in a vacuum.

At the hearing before myself, Mr Lockley further argued that this ground is undermined by the Appellant’s own evidence before the First-tier Tribunal. Mr Budhdeo is recorded, at paragraph 82(viii) of the Tribunal’s reasons, as having said that Jogee Pharma’s role was ‘robotic’ which implies that it was expected simply to follow instructions given to it by the Appellant.