DATA PROTECTION ACT 1998
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER
MONETARY PENALTY NOTICE
To: Cathay Pacific Airways Limited
Of: 4th Floor Waterfront Building, Manbre Road, London, Hammersmith
Embankment, W6 9RU
1. The Information Commissioner ("Commissioner") has decided to
issue Cathay Pacific Airways Limited ("Cathay Pacific") with a
monetary penalty under section SSA of the Data Protection Act
1998 ("the DPA"). This penalty is in relation to a serious
contravention of the seventh data protection principle ("DPP7") by
Cathay Pacific.
2. This notice explains the Commissioner's decision.
Legal framework for this Notice
3. The DPA implements European legislation (Directive 9S/46/EC)
aimed at the protection of the individual's fundamental right to the
protection of their personal data. The DPA must be applied so as
to give effect to that Directive.
4. The DPA applies to data controllers. Section 1 of the DPA provides
that:
(1) 'data controller' means, subject to subsection (4), a
person who (either alone or jointly or in common with other
1
persons) determines the purposes for which and the manner
in which any personal data are, or are to be, processed.
5. Section 5 of the DPA provides that:
(1) Except as otherwise provided by or under section 54, this
Act applies to a data controller in respect of any data only
if-
(a) the data controller is established in the United Kingdom
and the data are processed in the context of that
establishment,
(3) For the purposes of subsections (1) and (2), each of the
following is to be treated as established in the United
Kingdom-
(d) any person who does not fall within paragraph (a), (b) or
(c) but maintains in the United Kingdom-
(i) an office, branch or agency through which he carries on
any activity, or
(ii) a regular practice;
and the reference to establishment in any other EEA State
has a corresponding meaning.
6. Cathay Pacific is incorporated in Hong Kong, but maintains a branch
in the United Kingdom (registered with Companies House, with UK
establishment number BR001755). As such, it is "established in the
UK" by virtue of section 5(3 )( d)(i) of the DPA. Moreover, that
branch is engaged in the operational activities necessary to provide
airline services, and therefore processes data in connection with
those activities directly. The DPA therefore applies to Cathay Pacific
as a data controller.
7. Section 4(4) of the DPA provides that, subject to section 27(1) of
the DPA, it is the duty of a data controller to comply with the data
protection principles in relation to all personal data in respect of
which he is the data controller.
2
8. Schedule 1 of the DPA contains the eight data protection principles.
In the present case, the relevant principle is DPP7, which stipulates
as follows:
7. Appropriate technical and organisational measures shall
be taken against unauthorised or unlawful processing of
personal data and against accidental loss or destruction of,
or damage to, personal data.
9. As regards DPP7, the interpretative provisions in Part II of
Schedule 1 to the DPA provide that:
The seventh principle
9. Having regard to the state of technological development
and the cost of implementing any measures, the measures
must ensure a level of security appropriate to-
(a) the harm that might result from such unauthorised or
unlawful processing or accidental loss, destruction or
damage as are mentioned in the seventh principle, and
(b) the nature of the data to be protected.
10. The data controller must take reasonable steps to ensure
the reliability of any employees of his who have access to the
personal data.
11. Where processing of personal data is carried out by a
data processor on behalf of a data controller, the data
controller must in order to comply with the seventh
principle-
(a) choose a data processor providing sufficient
guarantees in respect of the technical and
organisational security measures governing the
processing to be carried out, and
(b ) take reasonable steps to ensure compliance with those
measures.
12. Where processing of personal data is carried out by a
data processor on behalf of a data controller, the data
3
controller is not to be regarded as complying with the
seventh principle unless-
(a) the processing is carried out under a contract-
(i) which is made or evidenced in writing, and
(ii) under which the data processor is to act only on
instructions from the data controller, and
(b) the contract requires the data processor to comply with
obligations equivalent to those imposed on a data
controller by the seventh principle.
10. Section SSA of the DPA empowers the Commissioner to issue
monetary penalties. The relevant provisions are as follows:
(1) The Commissioner may serve a data controller with a
monetary penalty notice if the Commissioner is satisfied
that-
(a) there has been a serious contravention of section
4(4) by the data controller,
(b) the contravention was of a kind likely to cause
substantial damage or substantial distress, and
(c) subsection (2) or (3) applies.
...,,.
(3) This subsection applies if the data controller
(a) knew or ought to have known -
(i) that there was a risk that the contravention
would occur, and
(ii) that such a contravention would be of a
kind likely to cause substantial damage or
substantial distress, but
(b) failed to take reasonable steps to prevent the
contravention.
11. The Data Protection (Monetary Penalties) (Maximum Penalty and
Notices) Regulations 2010 prescribe that the amount of any
penalty determined by the Commissioner must not exceed
fS00,000.
4
12. The Commissioner has issued statutory guidance under section
55C(l) of the DPA about the issuing of monetary penalties that has
been published on the Commissioner's website.
Background to the Case
13. Cathay Pacific is an airline, based in Hong Kong, flying to some 200
destinations around the world. In 2018, it (together with its local
subsidiary, Cathay Dragon) carried 35.5 million passengers. In the
course of providing airline services, Cathay Pacific collects the
personal data of its passengers, including their passport numbers,
names, contact details, dates of birth and nationalities.
14. In addition, Cathay Pacific operates a loyalty scheme, which
rewards passengers who choose to fly with them. For that purpose,
it also retains membership numbers, historical travel information
and customer service information.
15. This Notice concerns a large-scale data breach which came to light
in May 2018, but which had been ongoing since at least 15 October
2014. The breach affected four of Cathay Pacific's systems:
(1) System A, a reporting tool which compiles reports on a
number of different databases, including its customer
database.
(2) System B, used for processing and recording the
membership details of data subjects in the member group.
(3) System C, a shared back-end database primarily used to
support web-based applications.
5
(4) System D, a transient database which allows Asia Miles
members to redeem non-air awards. I
16. Cathay Pacific first became aware of suspicious activity on 13
March 2018, when subjected to a brute force attack against its
Active Directory database. This attack originated from an IT service
provider's server which provided support to Cathay Pacific.
17. This attack prompted Cathay Pacific to launch an investigation. It
instructed an independent third party, which it described to the
Commissioner as a "leading cybersecurity firm", to assist in this
investigation. The third party identified two groups of attackers,
which it concluded were separate from each other due to the
different tactics, techniques and procedures used.
(1) Group 1 was responsible for the attack on System A, and
Cathay Pacific has not been able to establish how access to
the network was achieved.
(2) Group 2 was responsible for the attack on Systems B, C and
D. It appears that Group 2 entered first via an internet-facing
server. Once able to move laterally within Cathay Pacific's
environment, the attackers were able to install malware to
harvest credentials from 10 August 2017. Using these
credentials, Group 2 was then able to access a remote VPN,
an external facing application platform and an administrative
console.
18.• The investigation concluded that the earliest known date of
unauthorised access to Cathay Pacific's systems had been 15
October 2014. The earliest known date of unauthorised access to
personal data was 2 July 2015. As a result of remediation
6
measures, the last day of unauthorised access to the personal data
was 11 May 2018.
19. In total, approximately 9.4 million data subjects were affected by
the data breach. Of these, 233,234 were from the EEA, and
111,578 were from the UK. 199,714 passport numbers issued by
an EEA Member State were accessed. The breach encompassed a
variety of types of personal data (in a variety of quantities),
namely: passenger names, nationalities, dates of birth, phone
numbers, email addresses, postal addresses, passport and identity
card numbers, frequent flyer membership numbers, customer
service remarks and historical travel information. 1
20. The Commissioner first became aware of the breach when Cathay
Pacific self-reported on 25 October 2018. Cathay Pacific explained
that several months were required to analyse the data and fully
understand the impact of the breach, as well as to put in place
customer care facilities and comprehensive and accurate individual
notifications.
21. Cathay Pacific received some 12,000 complaints arising from the
data breach, from customers worldwide. (Cathay Pacific was
unable to confirm how many of these related to UK or EEA citizens.)
The Commissioner received two complaints.
22. There have been no cases of confirmed misuse of the personal data
accessed by the attackers. However, given the nature of the
information, including passport numbers, it is likely that social
engineering phishing attacks against those data subjects will be
1
20 EEA credit card numbers were also compromised. However, the chance of
fraudulent use of these cards was low, as no CVV numbers were attached, and only
two had expiry dates (one full, one partial). It is also likely that the cards had all
expired by the time of the breach.
7
successful in the future, as the confidential information can be used
to convince victims of legitimacy.
The contravention: DPP7
23. The Commissioner finds that Cathay Pacific contravened DPP7, due
to a number of deficiencies in its data security.
24. The Commissioner finds that the contraventions were as follows.
(1) The database backups were not encrypted. This was contrary
to Cathay Pacific's own policy, which requires data backups
which contain personal data to be encrypted. If this policy
had been followed, and the backups had been encrypted, the
attackers would not have been able to access any personal
data.
Cathay Pacific has explained that an exception had been
made to the usual policy of encryption because a major data
centre migration project was taking place. However,
according to Cathay Pacific's Exceptions Policy, a form should
be completed setting out why a particular policy could not be
adhered to, the risks attached to that non-compliance and
any measures which could be put in place to reduce or avoid
those risks. The exception should then be registered with the
Information Security Team. Cathay Pacific could not provide
any evidence that the Exceptions Policy was adhered to in
this case. Had that process been carried out, the risks of the
lack of encryption would have been identified and either
prevented or mitigated by alternative measures.
8
(2) The internet-facing server was accessible due to a known and
publicised vulnerability. Cathay Pacific suspects (but could
not definitely say) that one internet-facing server was
accessed by exploiting a vulnerability that had been
published via the Common Vulnerabilities and Exposures
("CVE") system on 21 February 2007. The vulnerability had
been described as allowing "remote attackers to bypass
authentication and gain administrative access via direct
request". The complexity of the vulnerability was described
as low - meaning "very little knowledge or skill is required to
exploit" it, and instructions on how to fix the vulnerability
were provided.
Cathay Pacific did not apply the fix to the server, despite both
the vulnerability and the fix having been public knowledge
for over 10 years (by the end of the breach). Cathay Pacific
said that its vulnerability scanning had not detected the
vulnerability. However, its vulnerability scanner had been
scanning for the relevant vulnerability since 2014. This shows
that Cathay Pacific failed to manage its vulnerability scanning
appropriately, enabling the attackers to exploit it as part of
the data breach to carry out reconnaissance from the
internet-facing server.
(3) The administrator console was publicly accessible via the
internet. This console should only have been accessible to
authorised Cathay Pacific employees or authorised third
party support teams. No risk assessment was carried out in
respect of the risks of affording third part access via a public
accessible website, despite such an assessment being
required by Cathay Pacific's third party access policy.
9
Cathay Pacific could have put in place controls which would
have prevented attackers from accessing the site. For
example, access could have been via a VPN, which would
have allowed a third party to access the console without
making the authentication page available to anyone with an
internet connection. Had a risk assessment been carried out,
per the policy, such controls could have been identified and
implemented to mitigate the risks.
(4) System A was hosted on an operating system that was (and
is) no longer supported. This means security updates were
no longer released for the operating system. We are unable
to say to what extent an out of date and insecure operating
system had on the attack other than to comment that it
creates an additional risk because it is no longer receiving
security updates. This creates an obvious target for attacks.
It also means systems used on this server that process
personal data, or support the processing of personal data,
will be at increased risk by nature of the operating system
being unsupported.
Cathay Pacific's IT Assets Lifecycle Management Policy
provides that hardware and software should be "refreshed"
upon reaching their end-of-life. This could involve either
replacement or enhancement of the relevant asset. Cathay
Pacific neither replaced the operating system nor purchased
any extended support. Had Cathay Pacific adhered to its
policy, System A would not have been hosted on an out-of
date and vulnerable operating system. Although it is not
possible to determine the extent to which this failing
contributed to the data breach, it self-evidently makes the
10
personal data on or connected to the server less secure than
they could be.
(5) Cathay Pacific could not provide evidence of adequate server
hardening. Server hardening is a recommended process
whereby any unnecessary applications, features, services
and ports are removed, thereby minimising attack points.
This was reflected in Cathay Pacific's policy that "all unused
ports must be de-activated to avoid illegal access." No server
hardening documentation was provided in respect of the
servers which hosted its customer database, System A or D,
(the last two systems of which have since been
decommissioned).
Having identified the relevant ports used by the attackers in
respect of each System, Cathay Pacific is unable to say
whether those ports were authorised to be open or not.
(6) Network users were germitted to authenticate past the VPN
without multi-factor authentication ("MFA"). MFA is a widely
recommended measure to ensure that users are genuine,
and not using misappropriated credentials. Some 41,000
users were able to access the VPN with just a user ID and
password, with no second factor method of authentication. If
Cathay Pacific had required MFA for every user, the attackers
would not have been able to use the stolen credentials to
access the VPN and the data breach would have been
avoided. If Cathay Pacific had at least carried out a risk
11
assessment of the single-factor authentication system, it
would have identified the risks and either implemented MFA
sooner or put in place compensating controls. In September
2018, Cathay Pacific began rolling out MFA across all users.
(7) The anti-virus protection was inadequate. The server which
hosted System B did not have anti-virus installed. Cathay
Pacific explained this by reference to compatibility issues with
the operating system. Cathay Pacific was unable to provide
evidence of anti-virus protection in respect of the server
hosting System C. If appropriate anti-virus protection had
been in place, the attackers' use of malicious software could
have been identified earlier.
(8) Patch management was inadequate. Cathay Pacific could not
provide any evidence of up-to-date patch management for
either System A or System C servers. It did provide patch
management logs in respect of the System B server, which
show that packages were installed on 25 and 26 September
2017, 11 November 2017 and 26 July 2018. For the 8 months
between November 2017 and July 2018, the relevant server
was missing 16 security updates which resolved publicly
(1111-----------
known vulnerabilities (12 of which were described as "easily
exploitable"). Similarly, log files for a compromised domain
controller ■) showed that no
patches were installed between June 2016 and May 2017,
during which time 12 Microsoft updates were made available.
If Cathay Pacific had operated more effective patch
management, attackers would have had less opportunity to
exploit known vulnerabilities.
12
(9) Forensic evidence was no longer available during the
Commissioner's investigation. As referred to above, some
servers were decommissioned following the data breach.
Cathay Pacific pointed to this as a reason that it was unable
to provide evidence to the Commissioner. However, it is clear
that these servers were forensically analysed during Cathay
Pacific's (and the third party cyber security firm) own
investigations. If Cathay Pacific had followed best practice in
terms of preservation of digital evidence, then more
information would have been available.
(10) Accounts were given inappropriate privileges. Several of the
compromised user accounts were members of the domain
administrator group, giving them full control of the domain.
The greater freedoms attached to these accounts afford
attackers more access to data and devices. Best practice is
that no day-to-day user accounts should be in the domain
administrator group other than the built-in Administrator
account for the domain. It is also best practice to adhere to
the concept of "just enough administration", whereby each
account is only given the tools it needs to perform its own
administrative tasks. Linked to that is the concept of "just in
time administration", whereby such permissions are afforded
for a limited period, rather than on a permanent basis.
These principles were reflected in the privileged accounts
standard used by Cathay Pacific. Had Cathay Pacific adhered
to these best practices and its own standards, rather than
having 90 accounts permanently in the domain administrator
group, it could have prevented the attackers from taking
control of the most privileged user account in the domain and
accessing other devices in its network.
13
(11) Penetration testing was inadequate. Systems should be
tested regularly - with some guidance suggesting at least
yearly - and after any major change. For System C, B and A,
Cathay Pacific was unable to provide information of when the
last test had taken place. In respect of the others, one had
not been tested since November 2016. That is a period of up
to three years without penetration testing. Given the quantity
and nature of the personal data held by Cathay Pacific, and
the pace with which cybersecurity threats evolve and become
more sophisticated, that is an inappropriately long period
without a penetration test.
(12) Retention periods were too long. Data in System B (used for
processing data of members of various loyalty schemes)
would be retained indefinitely, and would only be purged
after seven consecutive years of "inactivity". Cathay Pacific
explained that passengers would become "inactive" upon
requesting that their account or membership be terminated,
or upon dying. Seven years after that, the data would be
purged. Some of these details would have become obsolete,
for example numbers of expired passports. However, Cathay
Pacific's retention policies are consistent across systems, and
do not refer to the specific type of data in question.
If Cathay Pacific had applied more appropriate retention
periods, less personal data would have been compromised.
(It also contravenes the fifth data protection principle:
"Personal data processed for any purpose or purposes shall
not be kept for longer than is necessary for that purpose or
those purposes.")
14
25. Cathay Pacific did have in place a wide array of proactive security
measures and policies at the time of the attack. However, it failed
to effectively manage those solutions, or to adhere to its own
policies. Many of these failures and omissions were particularly
negligent given the quantity and nature of the personal data
controlled and processed by Cathay Pacific. If appropriate steps
had instead been taken, they could have prevented or limited the
scope or impact of the data breach, and/or ensured that the breach
could have been detected and remedied sooner.
26. The Commissioner has gone on to consider whether the conditions
under section SSA DPA were met.
Seriousness of the contravention
27. The Commissioner is satisfied that the contraventions identified
above were serious. This is because of the large number of data
subjects affected (9.4 million data subjects worldwide: 233,234
from the EEA; 111,578 from the UK), the types of personal data
which were compromised (and in particular the likelihood that they
could be used to perpetrate fraud), the number of failings identified
and the long duration of the breach (over 3.5 years).
28. The Commissioner is therefore satisfied that condition (a) from
section SSA(l) DPA is met.
Substantial damage or substantial distress
29. The Commissioner is satisfied that these contraventions were of a
kind likely to cause substantial damage or distress, given the types
of personal data which were compromised (and in particular the
likelihood that they could be used to perpetrate fraud). The large
15
scale of the breach - in terms of (i) data subjects, (ii) breadth of
personal data compromised and (iii) duration - would be likely to
cause distress to those affected.
30. The Commissioner also notes that Cathay Pacific has received
complaints from affected data subjects alleging economic loss, in
particular relating to frequent flyer miles, although (to her
knowledge) these complaints have not yet been substantiated.
31. The Commissioner is therefore satisfied that condition (b) from
section SSA{l) DPA is met.
Deliberate or Negligent Contravention
32. The Commissioner considers that the contraventions were not
deliberate.
33. However, the Commissioner is satisfied that Cathay Pacific ought
reasonably to have known that the contraventions would both (i)
occur and (ii) be of a kind likely to cause substantial distress. She
is further satisfied that Cathay Pacific failed to take reasonable
steps to prevent these contraventions. In reaching this view, the
Commissioner has had regard in particular to: the fact that in many
instances Cathay Pacific was failing to follow its own policies; the
fact that the best practices which were ignored were so
fundamental; the availability of knowledge about the various
vulnerabilities, whether via CVE or via notice from the service
provider; and the fact that available controls were not implemented
timeously or at all.
34. In light of all of the above, the Commissioner is satisfied that the
contraventions were negligent.
16
35. The Commissioner is, therefore, satisfied that condition (c) from
section SSA(l) DPA is met.
36. She is also satisfied that the procedural requirements under section
55B have been complied with. The latter included issuing a Notice
of Intent dated 10 September 2019 in which the Commissioner set
out her preliminary thinking.
37. The Commissioner received representations from Cathay Pacific in
response to the Notice of Intent, dated 14 November 2019, and
has taken these into account when making her final determination.
The Commissioner has considered all the circumstances and has
reached the view that it is appropriate to issue a monetary penalty
in this case. That view is based on the significant scale of the
contravention, particularly with regard to the amount of data
subjects involved, the nature of the processing, the susceptibility
of the compromised personal data to be used fraudulently, and
Cathay Pacific's failures to follow its own policies or implement
security measures which were known to be necessary. The
Commissioner has also considered the importance of deterring
future contraventions of this kind, both by Cathay Pacific and by
others. The Commissioner considers that the latter objective would
be furthered by issuing a monetary penalty in this case.
The amount of the penalty the Commissioner intends to impose
38. The Commissioner has also taken into account the following
aggravating features in this case:
(1) Cathay Pacific failed to follow its own policies, which
demonstrates that it was aware of the risks posed by its
omissions.
17
.
(2) The duration of the breach was three years and seven
months.
(3) Cathay Pacific did not follow best practice in retaining data
following the breach, in particular in relation to their
decommissioned servers. This has prevented the
Commissioner from having a comprehensive picture of
Cathay Pacific's actions and omissions in the relevant period
in relation to compromised systems.
(4) Cathay Pacific's failures related to several of the most
fundamental principles of data security. By way of
illustration, Cathay Pacific failed to satisfy no less than four
out of the five National Cyber Security Centre (''NCSC") basic
Cyber Essentials, namely:
#2 Choose the most secure settings for your devices
and software.
#3 Control who has access to your data and service -
extra permissions should only be given to those who
need them.
#4 Protect yourself from viruses and other malware.
#5 Keep your device and software up to date.
39. The Commissioner also considers that there are significant
mitigating factors to take into account, namely:
18
•
(1) Cathay Pacific has acted promptly and forthrightly since it
became aware of the data breach. In particular, it went
above and beyond its legal obligations in issuing appropriate
information to data subjects and co-operating with the
Commissioner's investigation.
40. However, taking into account the size and resources of Cathay
Pacific, the Commissioner considers that these steps were what
could be expected of such an organisation.
41. The Commissioner's underlying objective in imposing a monetary
penalty is to promote compliance with the DPA. She considers that,
given the nature, seriousness and potential consequences of the
contravention arising in this case, that objective would not be
adequately served by an unduly lenient penalty.
42. Furthermore, the Commissioner does not consider that Cathay
Pacific would be unable to pay a monetary penalty or be subjected
to undue financial hardship.
Conclusion
43. Considering all of the above, the Commissioner has decided that a
penalty in the sum of £500,000 (Five hundred thousand
pounds) is reasonable and proportionate given the particular facts
of the case and the underlying objective in imposing the penalty.
44. The monetary penalty must be paid to the Commissioner's office
by BACS transfer or cheque by Friday 13 March 2020 at the
latest. The monetary penalty is not kept by the Commissioner but
will be paid into the Consolidated Fund which is the Government's
19
general bank account at the Bank of England.
45. If the Commissioner receives full payment of the monetary
.. penalty by Thursday 12 March 2020 the Commissioner will
reduce the monetary penalty by 20% to £400,000 (Four
hundred thousand pounds). However, you should be aware
that the early payment discount is not available if you decide to
exercise your right of appeal.
46. There is a right of appeal to the First-tier Tribunal (Information
Rights)
against:
a) the imposition of the monetary penalty
and/or;
b) the amount of the penalty specified in the monetary penalty
notice.
47. Any notice of appeal should be received by the Tribunal within 28
days of the date of this monetary penalty notice.
48. Information about appeals is set out in Annex 1.
49. The Commissioner will not take action to enforce a monetary
penalty unless:
• the period specified within the notice within which a monetary
penalty must be paid has expired and all or any of the monetary
penalty has not been paid;
• all relevant appeals against the monetary penalty notice and any
variation of it have either been decided or withdrawn; and
20
• the period for appealing against the penalty and any variation of
it has expired.
50. In England, Wales and Northern Ireland, the monetary penalty is
recoverable by Order of the County Court or the High Court. In
Scotland, the monetary penalty can be enforced in the same
manner as an extract registered decree arbitral bearing a warrant
for execution issued by the sheriff court of any sheriffdom in
Scotland.
Dated the 10th day of February 2020
I
Stephen Eckersley
Director of Investigations
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 SAF
21
.
ANNEX 1
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998
RIGHTS OF APPEAL AGAINST DECISIONS OF THE
COMMISSIONER
1. Section 48 of the Data Protection Act 1998 gives any person upon
whom a monetary penalty notice or variation notice has been served a
right of appeal to the First-tier Tribunal (Information Rights) (the
'Tribunal') against the notice.
2. If you decide to appeal and if the Tribunal considers:-
a) that the notice against which the appeal is brought is not in
accordance with the law; or
b) to the extent that the notice involved an exercise of discretion by
the Commissioner, that she ought to have exercised her discretion
differently,
the Tribunal will allow the appeal or substitute such other decision as
could have been made by the Commissioner. In any other case the
Tribunal will dismiss the appeal.
3. You may bring an appeal by serving a notice of appeal on the
Tribunal at the following address:
GRC & GRP Tribunals
PO Box 9300
Arnhem House
31 Waterloo Way
Leicester
LEl 8DJ
a) The notice of appeal should be sent so it is received by the
Tribunal within 28 days of the date of the notice.
22
.
b) If your notice of appeal is late the Tribunal will not admit it unless
the Tribunal has extended the time for complying with this rule.
4. The notice of appeal should state:-
a) your name and address/name and address of your representative
(if any);
b) an address where documents may be sent or delivered to you;
c) the name and address of the Information Commissioner;
d) details of the decision to which the proceedings relate;
e) the result that you are seeking;
f) the grounds on which you rely;
g) you must provide with the notice of appeal a copy of the
monetary penalty notice or variation notice;
h) if you have exceeded the time limit mentioned above the notice
of appeal must include a request for an extension of time and the
reason why the notice of appeal was not provided in time.
5. Before deciding whether or not to appeal you may wish to consult
your solicitor or another adviser. At the hearing of an appeal a party
may conduct his case himself or may be represented by any person
whom he may appoint for that purpose.
6. The statutory provisions concerning appeals to the First-tier
Tribunal (Information Rights) are contained in sections 48 and 49 of,
and Schedule 6 to, the Data Protection Act 1998, and Tribunal
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules
2009 (Statutory Instrument 2009 No. 1976 (L.20)).
23