The Court of Appeal (Newey, Asplin and Stuart-Smith LJJ) has today handed down judgment in Doorstep Dispensaree Ltd v Information Commissioner [2024] EWCA Civ 1515. Doorstep was a pharmacy that received the first monetary penalty under the GDPR and Data Protection Act 2018 for a range of poor data protection practices. Doorstep appealed on numerous grounds to the First-tier Tribunal (which reduced the penalty, due to a mistake of fact by the Commissioner) and then Upper Tribunal (which dismissed all grounds).
On the only two grounds granted permission by the Court of Appeal, the Court held that (1) the burden of proof in an appeal under s.163-163 DPA 2018 is on the Appellant throughout (¶41), and (2) while the First-tier Tribunal should make its own findings of primary fact (¶56), it is entitled to give weight to the views of the Information Commissioner, as an expert regulator, on matters of judgment or discretion, such as on the gravity of a breach, or what constitutes an ‘effective and dissuasive’ penalty (¶57-58). The judgment brings welcome clarity on these basic issues – not least for the Commissioner.
Peter Lockley appeared for the Information Commissioner, unled in the FTT and UT, and led by Ben Jaffey KC in the Court of Appeal.
