[2023] UKUT 132 (AAC)

- paragraph 56 of the skeleton argument. The Tribunal did not disregard the submission that the Commissioner’s finding of careless storage was contradicted by CCTV evidence (see paragraphs 65(xi) and 83 of the Tribunal’s reasons);

- paragraph 56(7). The Tribunal did not err in law by failing expressly to deal with the argument that, at the breach date, the GDPR had only been in force for two months and the Commissioner had yet to publish an enforcement policy. A tribunal is not required to set out, and respond to, each and every submission made. The Tribunal said that it considered both parties’ submissions with care but only summarised those central to its decision (paragraph 66 of the reasons). Doubtless, the Tribunal considered this particular submission of modest weight. The advent of the GDPR was accompanied by significant publicity and it is difficult to see what difference a published enforcement policy would have made to a data controller that, as the Tribunal found, had “[failed] to demonstrate adequate data protection policies more than a year after serious concerns were drawn to its attention” (paragraph 100 of the reasons);

- paragraph 56(8). The MPN noted that the present case was the Appellant’s first infringement. In this respect, the Tribunal adopted the Commissioner’s analysis, and the point was not therefore overlooked;

- paragraph 56(9). Again, the point made was not overlooked;

- paragraph 56(10). This paragraph of the skeleton argument asserted that the Appellant had promptly, and without waiting for the involvement of the Commissioner’s office, ‘bettered its data protection programme’. The point was not overlooked. The Tribunal made findings of fact inconsistent with the assertion made (paragraphs 97 to 99 of the reasons);

- paragraph 56(11). The Tribunal dealt with the Appellant’s submissions regarding the financial impact of the Commissioner’s MPN (paragraph 93 of the reasons).

Ground seven – delay in Tribunal making its decision