[2023] UKUT 132 (AAC)

At the hearing of this appeal, Mr Coppell clarified sub-ground 6(h). The points that the Tribunal failed to deal with were: arguments that the Commissioner’s finding of careless storage was contradicted by CCTV evidence; at the date of the breach, the Commissioner had yet to publish his enforcement policy; this was the Appellant’s first MPN; there was no evidence of any financial harm, distress or embarrassment to any data subject; the Appellant had, of its own volition, taken steps to ‘better’ its data protection practises and there was nothing to suggest that, since 2019, it had been anything other than fully compliant; given the size of the Appellant’s undertaking, the amount of the penalty was “totally disproportionate” and bound to put it out of business.

In response to the Commissioner’s argument that this ground discloses no error on a point of law, the Appellant submits that the credibility and paucity of the Commissioner’s evidence before the Tribunal, caused by his failure either to carry out any investigation or examine the data in question, were highly relevant to penalty amount. Their relevance was heightened by the Commissioner’s failure to offer any explanation for his “extraordinary failure” and that his evidence was incapable of being challenged in cross-examination. The Appellant should not have been left to make his own inspection to ascertain the correct number of documents. The Commissioner relied entirely on the ‘secondary account’ of the MHRA, a body with no particular expertise in data protection matters, yet failed to acknowledge that this diminished the value of his evidence. The Tribunal also failed to make ‘some allowance’ for the fact that, at the date of the breach, the GDPR had only been in force for two months.

At the hearing of this appeal, I asked Mr Coppel whether the Tribunal was asked to take into account the argument that, for a year, the Commissioner had refused the Appellant access to the breach documents. According to my notes, Mr Coppel consulted his instructing solicitor, and I was informed that it should have been apparent that the Commissioner was required to give the Appellant immediate access to the documents.

At the hearing, Mr Coppel submitted that sub-ground (f) related to the Appellant’s argument before the Tribunal that documents were brought onto the premises pursuant to contractual arrangements between Jogee Pharma and care homes. This argument, which was rejected in paragraph 94 of the Tribunal’s reasons, was relevant to the application of Article 83(2)(a) to (d) of the GDPR.

The Commissioner argues that, generally, this ground fails to identify legal flaws in the Tribunal’s penalty-setting exercise. Most of the sub-grounds relate not to the penalty-setting exercise but to logically prior matters and, moreover, some are simply arguments about the facts.

According to the Commissioner, sub-grounds (a) and (b), which concern the Commissioner’s ‘credibility’, aim at the wrong target. Matters of credibility relate to a Tribunal’s weighing of evidence when resolving disputed matters of fact. In any event, the Tribunal explained how the reduced number of breach documents affected its penalty-setting determination. At the hearing, Mr Lockley argued that the assertion that the Commissioner failed even to look at the breach documents was contradicted by paragraph 58 of the Tribunal’s reasons.

Sub-paragraph (c) relates, argues the Commissioner, to the Tribunal’s primary findings of fact. To the extent that the Tribunal’s finding about the credibility of Mr Budhdeo’s evidence is challenged, the Commissioner reminds the Upper Tribunal of long-established principles that a second-tier appellate body should be slow to interfere with first-tier findings of fact. In this case, the Tribunal was entitled to draw an adverse inference against a witness who, in the hearing room, changed his account when confronted with contradictory material especially where, as here, the contradiction concerned a matter which would not normally escape a reasonable person’s memory, namely holding a directorship. This topic arose naturally in cross-examination and the Tribunal’s findings are not flawed even if, as the Appellant submits, it was ultimately of no relevance to the determination of any substantive issue. In any event, the topic was not without potential relevance since there was a live issue as to who had access to the yard from which the breach documents were seized, and ownership of the Premises was certainly not irrelevant to that issue.

Sub-ground (d), argues the Commissioner, is another challenge to the Tribunal’s primary findings of fact. In any event, it is framed in terms that hardly admit of a response. The impugned paragraph 84 of the Tribunal’s reasons simply applies primary findings of fact and gives a sustainable reason for rejecting an aspect of the Appellant’s case. The approach described in paragraph 84 is entirely orthodox and correct.

While sub-ground (e) does formulate a coherent point of law, accepts the Commissioner, it does so in terms that are ‘hopelessly generic’. To simply assert there was ‘no basis’ for nine paragraphs of the Tribunal’s reasons is not good enough. If the Appellant argues that the Tribunal paid undue deference to the Commissioner’s decision, it is based on a misconception. Undue deference is not shown by pointing out that a tribunal’s decision largely corresponded to the decision under appeal. On any fair reading of paragraphs 88 to 96 of the Tribunal’s reasons, it is clear that the Tribunal turned its own mind to the issues and did not unthinkingly adopt the Commissioner’s analysis.

Sub-ground (f) is a further attack on the Tribunal’s fact-finding, submits the Commissioner. The impugned finding was free of legal error. The Tribunal was entitled to reject Mr Budhdeo’s conjecture, or speculation, as implausible and ‘countervailing evidence’ was not required.

The legal issue raised by sub-ground (g), argues the Commissioner, concerns liability rather than penalty amount. The Appellant fails to explain why the finding that it was the data controller should influence the penalty-setting exercise rather than the prior question of liability. Rather than identifying a flaw in the Tribunal’s reasoning the Appellant simply asserts that the Tribunal failed to resolve the point, which is clearly wrong: the point was dealt with in paragraph 82(ix) of the Tribunal’s reasons.

The Commissioner argues that sub-ground (h) is misconceived and does not come close to establishing an error of law. The argument that the Tribunal overlooked parts of the Appellant’s skeleton argument does not stand up to analysis: