[2023] UKUT 132 (AAC)

The Tribunal did not err in law as described in the sub-grounds of Ground 6 and this ground is not made out. By reference to those sub-grounds, my reasons are as follows:

it is not obvious why the ‘general credibility’ of the Commissioner / the Commissioner’s evidence should have been relevant at the penalty-setting stage of the Tribunal’s consideration of the appeal. If the argument is that the penalty-setting stage involved findings of fact as to the severity of the Appellant’s contraventions of the GDPR and, at this point, the Commissioner’s credibility was improperly left out of account, I reject it. The argument is based on an unproven assertion that the Commissioner’s investigation involved ‘serious methodological flaws’;

this sub-ground is also based on an unproven assertion - that the Commissioner acted improperly – and fails to establish any error on a point of law;

the Tribunal heard live evidence from Mr Budhdeo and I remind myself that the Upper Tribunal should be slow to interfere with a tribunal’s assessment of a witness’ oral evidence. The argument that it was not open to the Tribunal to reject Mr Budhdeo’s explanation for having failed to remember that he, and not his brother, was the director of a particular company cannot succeed. The Tribunal, having assessed Mr Budhdeo giving evidence in person, was entitled to regard his explanation as fanciful. I am also satisfied that the Tribunal did not act unfairly by permitting Mr Budhdeo to be questioned about his role in this particular company. I agree with Mr Lockley for the Commissioner that the topic was capable of being relevant to the question of who had access to the Premises, which was an issue before the Tribunal. In any event, the Appellant was represented by counsel before the First-tier Tribunal and it is not argued that counsel objected to this line of questioning at the time, which is a further reason for rejecting Ground 6(c);

it is not correct that the Commissioner adduced no evidence whatsoever before the Tribunal. His case was supported by various items of written evidence. In my judgment, the Tribunal’s analysis was not, or was not to any great extent, based on a finding of paucity of evidence on the part of the Appellant. It is true that the Appellant’s evidence was considered lacking in the sense that it failed to persuade the Tribunal of various matters but that was a qualitative, not quantitative, consideration. Many relevant matters of fact were accepted by the Appellant, as set out in the Tribunal’s reasons, and the Tribunal’s finding that Mr Budhdeo’s evidence lacked credibility did not rely on a finding that, in general, there was a lack of evidence provided by the Appellant;

this sub-ground strays in the territory occupied by Ground 2. In any event, the Tribunal did not defer to the Commissioner’s conclusions on ‘every aspect of the case’ save the number of documents. The Tribunal found an additional breach of the GDPR and declined to reduce the penalty amount in proportion to the reduction in the number of breach documents;

since the Upper Tribunal’s jurisdiction is limited to errors on points of law, I take this sub-ground to argue that it was not open to the Tribunal, on the evidence before it, to reject the argument that breach documents originated from care homes. The argument is not made out. The Tribunal gave intelligible reasons for rejecting the argument. In any event, it is not clear to me how this consideration had relevance beyond the liability stage of the Tribunal’s consideration;

the issue was whether the Appellant retained responsibility, as controller, for Joogee Pharma’s breaches. This issue was addressed, and the Tribunal’s conclusions properly explained. In any event, it is again not at all clear why this issue was relevant at the penalty-setting, as opposed to the liability of breach, stage to of the Tribunal’s consideration;

I find none of the arguments in this sub-ground persuasive. The Appellant does not argue that the Tribunal overlooked some transitional period during which there was an easing of the GDPR’s requirements. The fact that the GDPR had only been in force for some two months at the date of the breach did not lessen the Appellant’s obligation to comply with its requirements and the present breaches would almost certainly also have breached some requirement of the predecessor data protection legislation. It is not as if, before the GDPR came into force, it was acceptable to store large quantities of documents containing sensitive personal data outdoors in unlocked crates/boxes. Endeavouring to view matters objectively, it seems to me that the CCTV evidence argument was difficult to square with the agreed facts before the Tribunal, which included that the MHRA seized from the premises 73,000 documents stored in unlocked crates, boxes and bags. Moreover, the Tribunal did in fact refer to the CCTV evidence in its reasons (see paragraphs 65(xi) and 83). If the Commissioner had not published an enforcement policy at the date of the breach, this did not absolve the Appellant of its duty to comply with the GDPR and it was not argued before the Tribunal that the Appellant was waiting for a published enforcement policy to tell it what to do in order to comply with the GDPR. The Tribunal took into account the absence of evidence that any data subject had suffered any financial harm, distress or embarrassment since this was addressed in a part of the MPN’s analysis with which the Tribunal agreed. The Tribunal also took into account steps taken by the Appellant subsequent to the breach date; it may not have agreed with the Appellant that the steps were adequate but that is not the same thing as overlooking them (see paragraphs 97 to 99 of the Tribunal’s reasons). That this was the Appellant’s first infringement was also mentioned in the Tribunal’s reasons (paragraph 56(8)). Finally, the Appellant could not have argued before the Tribunal that a penalty of £92,000 was bound to put it out of business because it went into the appeal facing a penalty of £275,000 and, in any event, financial implications were dealt with at paragraph 93 of the Tribunal’s reasons.