The burden of proof in appeals against ICO Notices
The burden of proof in appeals against ICO Notices
In Doorstep Dispensaree Ltd v Information Commissioner [2024] EWCA Civ 1515 (“Doorstep Dispensaree”), the Court of Appeal addressed where the burden of proof lies when someone on whom the ICO has imposed a penalty under section 155 of the DPA 2018, appeals against it. Counsel for Doorstep Dispensaree argued that while the DPA 2018 does not expressly provide for the ICO to bear the burden of proof on an appeal under section 163 of the Act, this was implicit. He argued that where the imposition of a penalty is in issue, it is for the body imposing that penalty to justify it (see [38] of Doorstep Dispensaree).
Newey LJ, with whom the rest of the Court of Appeal agreed, rejected this proposition and held that the burden of proof lies on the appellant in an appeal against the imposition of a penalty under section 155 of the DPA 2018. He acknowledged that before raising a penalty notice, the ICO must be satisfied that one of the conditions in section 155(1)(a) and (b) of the DPA 2018 is met and that it is appropriate to require the person to pay the penalty. Newey LJ decided, however, that where the recipient of a penalty notice appealed under section 163, it was incumbent on him to persuade the FTT that the penalty should not stand.
At [39], Newey LJ placed reliance on the general principle enunciated by Carnwath LJ in Khan v HM Revenue and Customs [2006] EWCA Civ 89 (“Khan”), that “…where a state gives a right of appeal against enforcement action taken by a public authority, the burden of establishing the grounds of appeal lies on the person appealing” and the “ordinary presumption…is that it is for the appellant to prove his case” (see [71] and [73] of Khan). Newey LJ indicated that far from suggesting that this general principle was limited to the refusal of benefits rather than the imposition of penalties, Carnwath LJ had explained that it applied to enforcement notices in respect of breaches of planning control and that this approach represented the correct starting point in relation to an appeal against a civil penalty.
Newey LJ noted at [39] that in Doorstep Dispensaree, as in Khan, the appellant, rather than the ICO, knew or was in a position to know, the true facts. Newey LJ also confirmed that the fact that the FTT considers matters “afresh” on an appeal under section 163 of the DPA 2018 was not inconsistent with the appellant bearing the burden of proof. He concluded that the burden of proof on an appeal against a penalty notice lay throughout on the appellant (see [40] and [41] of the judgment).
Having concluded that in a full merits review the FTT will normally be able to decide whether a penalty is justified without resorting to the burden of proof, Newey LJ confirmed that where that is not the case, the burden is on the appellant, not the ICO (see [42] of the judgment).
- Heading
- The decision of the Upper Tribunal is to allow the appeal The decision of the First-tier Tribunal made on 17 October 2023 was materially in error of law. It is SET ASIDE under section 12(2)(a) of the Tribunals, Courts and Enforcement Act 2007 (“TCEA
- REASONS FOR DECISION
- Introduction
- The decision under appeal
- A summary of the relevant factual background
- The FTT’s decision
- The FTT’s findings of fact
- The FTT’s conclusions
- The issues in this appeal
- Appeal ground 1
- Appeal ground 2
- Appeal ground 4
- Additional Reason 1
- The scope of the appeal - admitting the additional reasons arguments for consideration
- Permitting Privacy International to intervene in the appeal
- Permitting Clearview to rely on a written reply to Privacy International’s skeleton argument
- Reliance on the evidence filed by Privacy International
- Reliance on legal arguments not raised before the FTT
- Legal framework
- Relevant legislative provisions
- The GDPR
- The UK GDPR
- “Article 2 This Regulation applies to the automated or structured processing of personal data, including
- 1A. This Regulation also applies to the manual unstructured processing of personal data held by an FOI public authority This Regulation does not apply to
- “Article 3
- The 95 Directive
- The Law Enforcement Directive
- State immunity and foreign act of state
- Material scope: the caselaw
- Territorial scope: the caselaw
- The Travaux in respect of the GDPR
- The EDPB Guidelines
- Data subjects in the Union
- The burden of proof in appeals against ICO Notices
- Analysis
- The parties’ positions on material scope in brief
- What the FTT decided in relation to Article 2(2)(a)
- General approach to construction of the GDPRs
- Domestic authorities on comity, extra-territoriality and utility
- EU authorities on extra-territorial effect and comity
- Certainty and foreseeability
- Proportionality
- EU law authorities on the construction of Article 2(2)(a) of the GDPR
- Relevant comity principles
- Our construction of Article 2(2)(a)
- Analysis of Clearview’s proposed intersectional construction
- Alternative analysis based on the ICO’s construction
- Would regulation of Clearview’s data processing breach comity principles?
- Article 3(2)(b) GDPR: territorial scope
- What was the policy objective behind Article 3(2)(b)?
- The meaning of “related to” in Article 3(2)(b)
- The meaning of “behavioural monitoring” in Article 3(2)(b)
- Ground 1
- Ground 2
- Ground 3
- Ground 4
- Clearview’s Additional Reasons
- Additional Reason 1
- Additional Reason 2
- Additional Reason 3
- Additional Reason 4
- Conclusions
![[2025] UKUT 319 (AAC)](https://backend.juristeca.com/files/emisores/logo_3a2BKne.png)