[2024] UKUT 287 (AAC)

Mr Pitt-Payne relied upon three respects in which he submitted that the FTT erred in the conclusion it reached at paragraph 111 of its decision that there had been a serious contravention by DSG of its duty to comply with the data protection principles.

First, he submitted that the FTT had erred in conflating the consequences of the contravention with its seriousness. He submitted that these were distinct elements and that the consequences were relevant to the next section 55A criterion, namely whether the contravention “was of a kind likely to cause substantial damage or substantial distress”. He said that seriousness was a quality of the contravention; it required that the contravention reached a certain standard of gravity or degree of departure from (in this case) the level of protection that the data controller was required to provide by DPP7. However, the FTT failed to make any finding in this regard and none of the three factors referred to by the FTT in its paragraph 111 addressed the seriousness of the contravention.

In response to our questions, Mr Pitt-Payne acknowledged that the consequences of a contravention could have some bearing on its seriousness (contrary to his original submission). He said, however, that the FTT had failed to ask and answer the right question; it had not made any finding as to how far short of the applicable standard DSG had fallen.

Secondly, he submitted that it was irrelevant for the FTT to have taken into account the “expectations of individuals and society”, this was not pertinent to identifying the appropriate standard or how far below it DSG had fallen. Alternatively, if this was relevant, the FTT had erred because it had no evidence before it on this matter.

Thirdly, he contended that the FTT erred in respect of paragraph 111(b) in taking into account that there was “an unknown quantity of PAN capable of being used to indirectly identify a living individual”. We have already considered this complaint, finding that the FTT erred, when we considered Issue 2 and so we do not need to address this further.