[2023] UKUT 132 (AAC)

The Tribunal held that the civil standard of proof applies in proceedings on appeal against a MPN. I shall set out the Tribunal’s reasons in full since much of the argument on this appeal concerns them:

“47…(i) I have reminded myself of the principles relevant to determining the applicable standard of proof as summarised by the Upper Tribunal in [Hackett v HMRC [2020] UKUT 0212 (TCC)], to which the paragraphs cited below refer. In particular:

a.

As identified by Lord Hoffman in In re B (Children) (FC) [2008] UKHL 35, there are three categories of civil cases in which it has been suggested that the standard of proof may vary according to the gravity of the misconduct alleged or the severity of the consequences, the first of which is a case classified as civil for the purposes of Article 6 but where the criminal standard should apply due to the serious consequences of the proceedings [59];

b.

A number of authorities, including McCann v Crown Court at Manchester (2003) 1 AC 787, support the view that a serious consequence which imposes restrictions upon a person’s liberty may require the criminal standard to be applied even though the proceedings are civil in nature [60 – 61], although a deprivation of fundamental liberties is not always a necessary ingredient [76];

c.

In HMRC v Khawaja [2008] EWHC 1687 (Ch) 2008 Mann J concluded that the civil standard of proof applied to civil penalty proceedings in the tax context having identified the existence of parallel criminal proceedings, while noting…that this is only a starting point because, in some cases, the seriousness of the consequences or the nature of the claim is such that the criminal standard of proof is required [67];

d.

The civil standard may apply in civil proceedings even when these involve allegations of civil fraud and dishonesty, and assistance in identifying the applicable standard may be found in the language of the legislation [70];

e.

As determined by the Upper Tribunal in a subsequent hearing in Khawaja, the application of Article 6 to proceedings does not prevent the civil standard of proof from applying [74]; and

f.

As found by the Upper Tribunal in [Hannam v FCA [2014] UKUT 0233 (TCC)], an allegation in relation to which a person faces an unlimited financial penalty and reputational damage but in which fundamental liberties were not at risk does not necessarily fall within Lord Hoffman’s first category of cases [78].

(ii)

I have considered whether assistance may be found in the language of the DPA. This creates two distinct penalty regimes. The first is the s. 155(1) MPN regime, enacted in compliance with the UK’s obligations under the GDPR. An appeal against an MPN is to a civil tribunal, and is brought under same statutory provisions as appeals against other s. 155(1) notices, in relation to which it is agreed that the civil standard applies.

(iii)

The second penalty regime is framed by reference to a criminal process, set out in ss. 196 – 200. This uses the language of criminal offences, including indictable offences, of convictions before the criminal courts, the appropriate sanction for which may also be a penalty. The criminal offences created by the DPA are contained within a number of provisions. Prosecutions may be brought either by the Commissioner after ‘investigation’, or by or with the consent of the DPP. The behaviours to which the offences relate are described in terms of deliberate acts taken in relation to personal data rather than by reference to breaches of the GDPR.

(iv)

The language used in s. 155(1)(a) requires the Commissioner to be ‘satisfied’ that a breach of the GDPR has occurred. I accept…that this is reflective of the application of the civil standard of proof. I have noted the contrast between this language and that in s.200 that refers to the Commissioner’s investigation.

(v)

I conclude from this analysis a clear intention by Parliament to create two distinct penalty regimes, only one of which is overtly criminal in nature. Accordingly I conclude that an MPN issued pursuant to s. 155(1) is a civil penalty for domestic law purposes.

(vi)

I have also considered whether, notwithstanding this, an MPN issued under s. 155(1) ought to be treated as a criminal offence, at least to the extent that the criminal standard of proof must apply.

(vii)

I am not persuaded…that any appeal against a monetary penalty is a denial of a criminal offence for the purposes of Article 6, such that it should be afforded enhanced procedural protections. Even if I was so persuaded, Article 6 does not assist in relation to the applicable standard of proof (see Hackett [72-74]). I am satisfied that, in any event, the domestic common law requirements of a fair hearing apply to, and have been applied in, these proceedings, and that these meet Article 6 requirements of procedural protection in any event.

(viii)

I note that the provisions of s. 155(1)(b) allow an MPN to be imposed in addition to an information, assessment or enforcement notice, and that this reflects the provisions of Article 83 in which such a penalty is described as an ‘administrative fine’. I find that the use of this language in a European context is inconsistent with an intention to create a penal sanction amounting to a criminal offence. Moreover, the Commissioner may only impose an MPN under s. 155(1)(b) in circumstances where the person has failed to comply with the earlier notice. This means that an MPN may only be imposed:

a.

where the Commissioner is satisfied that a breach of relevant parts of GDPR has taken place (s. 155(1)(a)); or

b.

where a person served with an information, assessment or enforcement notice has failed to satisfy the Commissioner that no such breach of the GDPR subsists.

In either case the MPN is served in connection with established or suspected breaches of specified obligations under the GDPR.

(ix)

The language of s. 155(1)(b) differs significantly from that of the other regulatory regimes cited by Mr Coppel [for the Appellant] as examples of legislation in which the criminal standard applies to a fine is imposed for non-compliance with a enforcement notice. This is because, in contrast to Mr Coppel’s examples, s.155(1)(b) does not refer to the creation of ‘an offence’.

(x)

The right of appeal created by s. 162(1)(d) & (3) essentially replicates the right created by s. 55B(5) DPA 1998 – i.e. an appeal may be brought against an MPN and/or the quantum of the penalty. The well-established practice of this Tribunal under the earlier legislation is to apply the civil standard of proof. There is nothing in the language of the DPA to suggest an intention by Parliament to change the applicable standard of proof.

(xi)

The criteria identified in ss. 155(2) & (3) as relevant to the assessment of the quantum of the penalty are taken from Article 83. These are necessarily expressed in terms unconnected to offsetting any ‘benefit’ of non-compliance with GDPR obligations because the purpose of this aspect of the Regulation is to prevent the infringement of individual rights. Therefore the ‘cost’ of breaches of the GDPR is necessarily assessed on a different basis.

(xii)

Although the levels of MPN that may be imposed under s. 155(1) are significant and when imposed at the higher level must meet the description of ‘a serious consequence’, there is no additional consequent deprivation of a fundamental liberty…[the Appellant] may continue to operate as an online pharmacy, the MPN under appeal notwithstanding. Applying the principles identified in Hannam and Hackettto the circumstances of this appeal, I find that the potential quantum of a s.155(1) MPN is not by itself a sufficiently serious consequence so as to bring an appeal within the first category of cases identified by Lord Hoffman, thereby requiring application of the criminal standard of proof on the basis of serious consequence alone.

(xiii)

I therefore conclude that the civil standard of proof applies to an appeal under s. 162(d).”