![[2024] UKUT 287 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png){kind=logo}
Decision date: 23 September 2024
Decision date: 23 September 2024
Decided after a hearing on: 11 and 12 June 2024
Representation:
Appellant: Mr Timothy Pitt-Payne KC and Mr Rupert Paines of counsel, instructed by Pinsent Masons.
Respondent: Mr Peter Lockley of counsel, instructed by the Information Commissioner
DECISION
The decision of the Upper Tribunal is to allow the appeal by DSG Retail Limited.
As a consequence of our decision, and pursuant to section 12(2)(a) and 12(2)(b)(i) of the Tribunals, Courts and Enforcement Act 2007, we set aside the words “and is substituted by this Decision" in paragraph 1 and the whole of paragraph 2 of the First-tier Tribunal’s decision in EA/2020/0048, dated 5 July 2022. We remit the appeal to be redecided by an entirely freshly constituted First-tier Tribunal in accordance with the law in this decision and on the basis of the uncontested matters as set out in this decision.
REASONS FOR DECISION
Introduction
This appeal concerns the lawful basis for the Information Commissioner (“ICO”) imposing a monetary penalty notice (“MPN”) on a data controller under section 55A of the Data Protection Act 1998 (“DPA 1998”). A key issue on the appeal is the correct construction of the phrase “personal data” as it appears within the seventh data protection principle in Schedule 1 of the DPA 1998 (“DPP7”), which is concerned with data security. A three-judge panel of the Upper Tribunal was convened to hear the appeal because this issue of construction raises a question of law of special difficulty.
The structure of this decision is as follows:-
A summary of the relevant background 3
Seriousness of the contravention 12
Substantial damage and distress and knowledge 12
The grant of permission to appeal 14
The Upper Tribunal’s approach on appeal 16
Scope of grants of permission 17
Relevant provisions of the DPA 1998 17
Relevant case law and guidance on the meaning of “personal data” 20
Issue 1: the EMV Data Issue: the parties’ submissions 32
The appellant’s submissions 32
The respondent’s submissions 33
Issue 1: the EMV Data Issue: discussion and conclusions 34
The FTT’s reasoning and the FTT’s error 39
Issue 2: the Consistency Issue: the parties’ submissions 40
The appellant’s submissions 40
The respondent’s submissions 41
Issue 2: the Consistency Issue: discussion and conclusions 41
Scope of the grant of permission 42
Issue 3: the Procedural Fairness Issue 43
Issue 4: the Implications Issue: the parties’ submissions 44
The appellant’s submissions 44
The respondent’s submissions 44
Issue 4: the Implications Issue: discussion and conclusions 44
Issue 5: the Seriousness Issue: the parties’ submissions 45
The appellant’s submissions 45
The respondent’s submissions 46
Issue 5: the Seriousness Issue: discussion and conclusions 46
- Heading
- THE HON. MRS JUSTICE HEATHER WILLIAMS DBE
- Decision date: 23 September 2024
- A summary of the relevant background
- The ICO’s MPN
- The FTT’s decision
- Personal data
- The contravention of DPP7
- Seriousness of the contravention
- Substantial damage and distress and knowledge
- The substituted MPN
- The issues on this appeal
- The grant of permission to appeal
- The legal framework
- Scope of grants of permission
- Relevant provisions of the DPA 1998
- Relevant case law and guidance on the meaning of “personal data”
- Security of processing
- Relevant principle of judicial decision-making
- Issue 1: the EMV Data Issue: the parties’ submissions
- The respondent’s submissions
- Issue 1: the EMV Data Issue: discussion and conclusions
- The statutory provisions
- The case law
- The FTT’s reasoning and the FTT’s error
- Issue 2: the Consistency Issue: the parties’ submissions
- The respondent’s submissions
- Issue 2: the Consistency Issue: discussion and conclusions
- Scope of the grant of permission
- The FTT’s errors
- Issue 3: the Procedural Fairness Issue
- Issue 4: the Implications Issue: the parties’ submissions
- The respondent’s submissions
- Issue 4: the Implications Issue: discussion and conclusions
- Issue 5: the Seriousness Issue: the parties’ submissions
- The respondent’s submissions
- Issue 5: the Seriousness Issue: discussion and conclusions
- Conclusions