Bilgi Bildiriminde Kendini Suçlama Riski

Appeal number: EA/2018/0265

FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS

DOORSTEP DISPENSAREE Ltd Appellant

- and -

THE INFORMATION COMMISSIONER Respondent

TRIBUNAL: JUDGE ALISON MCKENNA (CP)
SUZANNE COSGRAVE
ALISON LOWTON

Sitting in public at Alfred Place London on 24 January 2019

For the Appellant: Steven Hayden, counsel
For the Respondent, Peter Lockley, counsel

DECISION

1. The appeal is dismissed.

REASONS
Background
2. This appeal concerns an Information Notice served by the Information Commissioner (“the
Commissioner”) on the Appellant company on 25 October 2018. The Commissioner’s power to serve
an Information Notice1, and the right of appeal to this Tribunal2, were introduced by the Data

1
Section 142 DPA 2018
2
Section 162 DPA 2018

---

Protection Act 2018 (“DPA 2018”)3. This is the first appeal to reach final determination under the
new regime. We are grateful to Mr Lockley on behalf of the Information Commissioner and to Mr
Hayden on behalf of the Appellant for their helpful oral submissions.
3. The Information Commissioner is currently investigating the Appellant’s compliance with the
General Data Protection Regulation (“GDPR”)4, in relation to which she is the UK supervisory
authority5. The Commissioner’s investigation was opened following a report to her office from the
Medicines and Healthcare Products Regulatory Agency (“MHRA”) in July 2018 about the manner in
which the Appellant company was apparently processing personal data.
4. The Commissioner requested in correspondence certain information from the Appellant in connection
with her investigation. The Appellant in correspondence refused to provide the requested information
and so the Commissioner decided to serve the Information Notice.
5. The Appellant appealed to the Tribunal. The lodgement of the Notice of Appeal has the effect of
suspending the Appellant’s obligation to comply with the Information Notice, pending determination
of this appeal6. If the appeal is dismissed, the Commissioner may bring enforcement proceedings in a
court.7
6. The Tribunal heard submissions from both counsel and, by agreement, rose to decide a preliminary
issue as to whether the Information Notice was invalid if compliance with its terms involved a risk of
self-incrimination by the recipient. We concluded that the Information Notice was not invalid on this
basis.
7. We considered the Appellant’s case in the light of our findings as to the preliminary issue and
announced at the hearing that the appeal was dismissed. These are our written reasons under rule 38
of the Tribunal’s Rules8.
The Appellant’s Case
8. The Appellant’s Notice of Appeal was lodged out of time, but the Tribunal agreed to admit it. The
Appellant requested an oral hearing of the appeal. The Tribunal accepted the Appellant’s witness
statements as evidence in chief and did not require oral evidence to be given.
9. The Appellant’s Notice of Appeal dated 28 November 2018 relied on two grounds of appeal, as
follows. Firstly, that “there are criminal investigations into the company by MHRA, as such the
proper way to question the company is via the criminal proceedings by way of interview of its
representatives under the Police and Criminal Evidence Act. To do otherwise would be in
contravention of the criminal code and the Human Rights Act…The questions are intended to assist
the MHRA’s criminal investigation and in effect MHRA were using the ICO to assist them without
recourse to due process and under the guise of requesting information under the Data Protection
Act…” .
10. Secondly, “Non-Disclosure. The ICO stated that its questioning arose as a result of the MHRA
contacting them, but failed to provide, although requested, disclosure as to the root of its concerns or
as appropriate disclosure…”.
11. At the hearing, Mr Hayden refined the Appellant’s case. He submitted that the Information Notice
was not in accordance with in law, as it was void for breach of s. 143(6) DPA 2018 which provides
that the recipient of an Information Notice may not be compelled to incriminate him/herself.

3
http://www.legislation.gov.uk/ukpga/2018/12/contents
4
https://eur-lex.europa.eu/eli/reg/2016/679/oj
5
Section 115 DPA 2018
6
Section 142(6) DPA 2018
7
Section 145 and section 180 DPA 2018
8
https://www.gov.uk/government/publications/general-regulatory-chamber-tribunal-procedure-rules

2

---

Although the section had not been referred to expressly in the Notice of Appeal or correspondence, he
submitted that the question of the Appellant’s right not to self-incriminate had been raised in the
grounds of appeal and that, as the Commissioner had been aware that a criminal investigation was on
foot, it had been wrong in principle for her to compel the Appellant to answer questions which might
provide evidence which could be used against it in criminal proceedings. The Appellant filed witness
evidence including a statement from the Appellant’s solicitor confirming that the company’s
superintendent had made no comment when interviewed under caution by MHRA.
12. Mr Hayden’s secondary submission was that, if the Information Notice was not void, then the
Tribunal should amend it to remove certain questions in the Notice which he submitted would have
the effect of compelling self-incrimination. The offending parts were some or all of questions 2, 3, 6
and 7 of the Information Notice. He confirmed he did not pursue the grounds that disclosure and/or
PACE compliance were required.
The Commissioner’s Case
13. The Commissioner’s Response dated 18 December 2018 opposed the appeal on the following
grounds. Firstly, that the MHRA’s investigation is entirely separate from that of the Commissioner,
whose concern (and duty) is to monitor and enforce the application of the GDPR. It is commonplace
for the Commissioner to conduct an investigation at the same time as other statutory agencies, but the
Commissioner’s focus is on GDPR/DPA only, and not on the criminal investigation being undertaken
by MHRA. Secondly, that ground two is based on a misunderstanding of the Commissioner’s role
and the Appellant’s duty to co-operate with her investigation. Further, that there is no requirement for
disclosure by the Commissioner before requiring an answer to an Information Notice.
14. The Commissioner asked the Tribunal to expedite the hearing of this appeal so as to progress its
investigation. The Tribunal set a hearing date on the first available date following the close of
pleadings.
15. In response to the Appellant’s case as put at the hearing, Mr Lockley submitted that Parliament had
provided the necessary safeguards in DPA 2018, such that the Appellant was at liberty to raise the
issue of s. 143(6) and the risk of self-incrimination in correspondence or in response to the service of
an Information Notice. The Commissioner would then have to consider whether to seek to enforce
the Information Notice through a court or to cancel the Notice. In summary, his submission was that
s. 143(6) DPA 2018 was relevant to the Appellant’s obligation to comply with the Information Notice
but did not affect the validity of a Notice which had been served.
16. As to the suggestion that the Tribunal should amend the Notice, Mr Lockley’s submission was that
the Notice was in accordance with the law so the appeal should be dismissed. He submitted that there
were no grounds on which the Tribunal could decide to exercise its discretion differently to that of the
Commissioner as there was no evidence before it about the precise scope of the criminal investigation
and the report from the MHRA showed clear cause for concern as to the Appellant’s GDPR
compliance.
The Law
17. Section 142 DPA 2018 provides the Commissioner with power to serve an Information Notice as
follows:

(1) The Commissioner may, by written notice (an “information notice”)—
(a)require a controller or processor to provide the Commissioner with information that the Commissioner
reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection
legislation, or
(b)require any person to provide the Commissioner with information that the Commissioner reasonably requires for
the purposes of—
(i)investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or
(ii)determining whether the processing of personal data is carried out by an individual in the course of a purely
personal or household activity.

3

---

(2) An information notice must state—
(a)whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and
(b)why the Commissioner requires the information.
(3) An information notice—
(a)may specify or describe particular information or a category of information;
(b)may specify the form in which the information must be provided;
(c)may specify the time at which, or the period within which, the information must be provided;
(d)may specify the place where the information must be provided;
(but see the restrictions in subsections (5) to (7)).
(4) An information notice must provide information about—
(a)the consequences of failure to comply with it, and
(b)the rights under sections 162 and 164 (appeals etc).
(5) An information notice may not require a person to provide information before the end of the period within which
an appeal can be brought against the notice.
(6) If an appeal is brought against an information notice, the information need not be provided pending the
determination or withdrawal of the appeal.
(7) If an information notice—
(a)states that, in the Commissioner's opinion, the information is required urgently, and
(b)gives the Commissioner's reasons for reaching that opinion,
subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of
the period of 24 hours beginning when the notice is given.
(8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.
(9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the GDPR, the
reference to a controller or processor includes a representative of a controller or processor designated under
Article 27 of the GDPR (representatives of controllers or processors not established in the European Union).
(10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).

18.Section 143 DPA 2018 (headed “Information Notices: Restrictions”) provides that:

(1) The Commissioner may not give an information notice with respect to the processing of personal data for the
special purposes unless—
(a) a determination under section 174 with respect to the data or the processing has taken effect, or
(b) the Commissioner—
(i) has reasonable grounds for suspecting that such a determination could be made, and
(ii) the information is required for the purposes of making such a determination.
(2) An information notice does not require a person to give the Commissioner information to the extent that
requiring the person to do so would involve an infringement of the privileges of either House of Parliament.
(3) An information notice does not require a person to give the Commissioner information in respect of a
communication which is made—
(a) between a professional legal adviser and the adviser's client, and
(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under
the data protection legislation.
(4) An information notice does not require a person to give the Commissioner information in respect of a
communication which is made—
(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another
person,
(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation,
and

4

---

(c) for the purposes of such proceedings.
(5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person
acting on behalf of the client.
(6) An information notice does not require a person to provide the Commissioner with information if doing so
would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.
(7) The reference to an offence in subsection (6) does not include an offence under—
(a) this Act;
(b)section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);
(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on
oath);
(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations
and other false unsworn statements).
(8) An oral or written statement provided by a person in response to an information notice may not be used in
evidence against that person on a prosecution for an offence under this Act (other than an offence under section
144) unless in the proceedings—
(a)in giving evidence the person provides information inconsistent with the statement, and
(b)evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that
person's behalf.
(9) In subsection (6), in relation to an information notice given to a representative of a controller or processor
designated under Article 27 of the GDPR, the reference to the person providing the information being exposed to
proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

19. The right of appeal to this Tribunal against an Information Notice is provided by ss. 162 and 163
DPA 2018 as follows:
162 Rights of appeal
(1) A person who is given any of the following notices may appeal to the Tribunal—
(a)an information notice;
(b)an assessment notice;
(c)an enforcement notice;
(d)a penalty notice;
(e)a penalty variation notice.
(2)A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application
under section 153 for the cancellation or variation of the notice.
(3)A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the
amount of the penalty specified in the notice, whether or not the person appeals against the notice.
(4)Where a determination is made under section 174 in respect of the processing of personal data, the controller or
processor may appeal to the Tribunal against the determination.
163 Determination of appeals

(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).
(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is
brought was based.
(3) If the Tribunal considers—
(a)that the notice or decision against which the appeal is brought is not in accordance with the law, or
(b)to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the
Commissioner ought to have exercised the discretion differently,
the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have
given or made.
(4) Otherwise, the Tribunal must dismiss the appeal.

5

---

(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled
or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.
(6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.

Conclusions
20. We agree with Mr Lockley’s analysis of the new legal framework, which we find to be as
follows. The Commissioner may serve an Information Notice in circumstances where she
requires a data controller or processor to provide her with information which she reasonably
requires for the purpose of carrying out her functions. The Information Notice must meet certain
procedural requirements. An Information Notice “does not require” a person to provide
information which would expose them to criminal proceedings. The Act does not say that the
Commissioner may not serve an Information Notice in such circumstances, or that it is invalid if
she does so. It is difficult to see how Parliament could have intended such an interpretation given
that the Commissioner would not generally be privy to the relevant information to allow her to
make that prospective judgement.
21. We are satisfied that the effect of s. 143 (6) DPA 2018 is to permit the recipient of an
Information Notice to raise the issue of risk of self-incrimination with the Commissioner on
receipt of the Notice. The Commissioner must then take those submissions into account in
deciding whether to apply to a court to enforce the Information Notice or to cancel the
Information Notice (possibly serving an amended Notice in its stead). In this case, the Appellant
has provided very limited information to the Commissioner and to the Tribunal about the scope
of the criminal investigation and thus the scope for self-incrimination. The Appellant claims to
have little information itself at this stage of those proceedings. However, it is clear from the
information provided to the Commissioner by MHRA, and placed before the Tribunal, that
whatever else may follow there is an issue as to GDPR compliance which warrants further
investigation. We accept that the information requested was reasonably required for the
Commissioner’s investigation.
22. The role of the Tribunal is to consider whether the Commissioner’s Notice is not in accordance
with the law and/or whether she should have exercised her discretion to serve it differently. The
Tribunal has power to substitute a fresh Information Notice if it allows the appeal. We are
satisfied in this case that the Information Notice is in accordance with the law and that the
Appellant has shown no basis for finding that the Commissioner should have exercised her
discretion differently. For these reasons, we dismiss the appeal.
23. We noted at the hearing that we had received no evidence from the Commissioner as to the
factors taken into account in making the decision to serve the Notice. Mr Lockley submitted that
they were obvious from the correspondence, but we would have found it helpful to have received
a short witness statement from the case officer.
24. We also noted that neither the Notice itself nor the accompanying letter specifically referred the
Appellant to the effect of s. 143(6) DPA 2018, notwithstanding the fact that the Commissioner
was aware of a parallel criminal investigation. We suggest that it would be fair for the standard
information given to recipients of Information Notices to refer expressly to s. 143 DPA 2018.

(Signed) Dated: 28 January 2019
Promulgation date: 30 January 2019
Alison McKenna
Chamber President

© CROWN COPYRIGHT 2019

6