[2023] UKUT 132 (AAC)

the term “satisfied”, in section 155(1)(a), DPA is relevant to the burden of proof not the standard;

the GDPR’s use of the term “administrative fine” is not determinative. Moreover, the term ‘civil penalty’ is not used in the DPA 2018, but is used in other legislation (for example, Finance Act 1994, section 9; Aviation Security Act 1982, section 22A; Companies Act 2006, sections 27, 453 and 463; Customs and Excise Management Act 1979, in numerous places);

features of a MPN that point to the criminal standard of proof were not taken into account namely its punitive character, that it may be an additional sanction for a breach already dealt with by coercive sanction, the penalty being fixed by reference to criteria that mimic those applied by criminal courts, the existence of a separate compensation regime, enforcement mechanism akin to that for a Magistrates’ Court fine, authorities cited to the Tribunal and the principle against doubtful penalisation.

it is relevant that, in a single Act, Parliament provided for two enforcement regimes only one of which is overtly criminal in nature;

given the DPA 2018’s creation of two distinct enforcement regimes, it is of note that the Act provides that the Commissioner need only be ‘satisfied’ of certain matters. The terminology is indicative of the civil standard of proof at the Commissioner’s investigative stage. The Tribunal’s role on appeal to ‘review any determination of fact’ made by the Commissioner suggests a review according to the same standard of proof as that applied by the Commissioner. The Commissioner cites numerous authorities to the effect that the First-tier Tribunal is to take afresh the decision taken by the Commissioner, that is take it in the same way;

the Tribunal did not draw an erroneous distinction between an ‘administrative fine’, which indicates a civil matter, and ‘an offence’, which denotes a criminal matter (see paragraph 47(viii) of the Tribunal’s reasons). The same distinction is drawn by the GDPR’s Recitals 151 (sanctions to take effect as criminal penalties only in States whose legal systems do not provide for administrative fines) and 152 (distinction drawn between ‘criminal’ and ‘administrative’ penalties). It is true that the GDPR’s terminology does not determine the standard of proof, but the Tribunal did not hold otherwise;

penalties are intended to be dissuasive rather than punitive (see Article 83(1) of the GDPR). The Tribunal did not overlook the potential for large penalties (see paragraph 47(xi) of its reasons) or that a MPN may be imposed alongside an Enforcement Notice (paragraph 47(viii)). In any event, an Enforcement Notice only requires the recipient to comply with the law and so it is not clear why the possibility of concurrent Notices should render the MPN a criminal penalty. The argument that the criteria for determining the amount of a penalty ‘mimic’ those for criminal fines is simply wrong and, in fact, they are more akin to those for determining civil fines. The Appellant’s reliance on the non-compensatory nature of MPNs makes no sense. Many tribunals lack coercive powers and must rely on a court to enforce their sanctions, but this does not render the sanctions criminal in nature.

section 93(4) of the Consumer Rights Act 2015: “where an enforcement authority is satisfied on a balance of probabilities that a person has breached a duty or prohibition…”;

section 10(2) of the Climate Change Act 2008: “…regulations may only confer such a power [to impose a fixed monetary penalty] in relation to a case where the administrator is satisfied on the balance of probabilities that the breach has occurred”;

section 146(1) of the Policing and Crime Act 2017: “The Treasury may impose a monetary penalty on a person if it is satisfied, on the balance of probabilities, that (a) the person has breached a prohibition…”;

section 28(1) of the Coronavirus Act 2020: “This section applies [so that a financial penalty may be imposed under subsection (2)] if an appropriate authority…is satisfied on the balance of probabilities that a person has, without reasonable excuse, (a) failed to comply with the requirement…”.