[2023] UKUT 132 (AAC)

The Appellant argues that the Tribunal, having held in paragraph 89 of its reasons that a breach of Article 24(1) of the GDPR was not a penalisable contravention under section 155(1) of the DPA 2018, nevertheless, in paragraph 90, agreed with the Commissioner that ‘serious breaches’ of data processing principles were “largely due to [the Appellant’s] negligence in relation to its Article 24(1) and Article 32 obligations”. This strongly suggests that the Tribunal’s MPN analysis relied on an impermissible consideration namely a supposed breach of Article 24(1).

The Commissioner accepts that the Tribunal was correct to find that the MPN wrongly referred to Article 24(1) of the GDPR since infringement of that Article cannot found a MPN. However, this matter formed no part of the Appellant’s case before the Tribunal and the issue was raised by the Tribunal of its own volition. It would be surprising had the Tribunal, after raising the issue itself, gone on to make the very error it had just identified. The comment in paragraph 90 of the Tribunal’s reasons merely expressed agreement with the Commissioner that the Appellant’s failure to implement appropriate technical and organisational measures was the main cause of Jogee Pharma’s contraventions.

Even if the Tribunal erred, submits the Commissioner, the error was not material. Article 24(1), like Article 32, requires a controller to adopt appropriate technical and organisational measures. While Article 24(1) is of potentially wider scope than Article 32, which is solely concerned with the security of processing, the MPN relied on both Articles interchangeably in that the Commissioner relied on both as having given rise to breach of Article 5(1)(f), which is the data protection principle concerned with the security of processing. The Tribunal took materially the same approach, and also found that the Appellant was liable for Article 5(1)(e) breaches by virtue of Article 5(2) (paragraph 83 of the Tribunal’s reasons). The Tribunal’s reference to Article 24(1) was immaterial to the outcome.

The Commissioner’s materiality arguments are wishful thinking, argues the Appellant, and contrary to principle. The Commissioner unjustifiably elides his findings with those of the Tribunal. The Upper Tribunal cannot be confident that, absent the Tribunal’s mistake, it would have arrived at the same conclusions. The Tribunal’s error cannot be considered immaterial.