We welcome the Court of Appeal (CoA) unanimous dismissal of an appeal by Doorstep Dispensaree Limited (DDL) against a monetary penalty notice (MPN) issued by the Commissioner on 17 December 2019.
In its judgement published today, the CoA rejected both grounds for appeal brought by DDL. The Court found that the burden of proof in an appeal lies with the appellant and subsequent tribunals and appeal courts are not required to start considering an appeal with a ‘blank sheet of paper’, essentially ignoring the MPN.
The case raised issues of considerable importance for ongoing and future appeals of penalties issued, and the Commissioner is grateful to the Court for clarifying the points of law.
John Edwards, UK Information Commissioner said:
“I welcome the Court of Appeal’s judgment in this case as it provides clarity for future appeals. We defended our position robustly and are pleased that the Court has agreed with our findings.”
Background
Doorstep Dispensaree, which supplied medicine to care homes, came to our attention when the Medicines and Healthcare Products Agency reported the company after it seized unlocked crates of sensitive personal information stored in publicly accessible premises. Following an investigation the Commissioner issued the first Data Protection Act 2018 MPN, and an Enforcement Notice, on 17 December 2019. On appeal to the First Tier Tribunal the fine was reduced to £92,000 after DDL provided evidence showing less personal information was involved. DDL sought permission to appeal the subsequent Upper Tribunal judgement on seven grounds and was given permission to appeal only two. Today’s Judgment follows a hearing that took place on 21 November 2024.