Appeal number: EA/2019/0353
FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
INFORMATION RIGHTS
PAUL CARRINGTON-GRETTON Appellant
- and -
THE INFORMATION COMMISSIONER Respondent
TRIBUNAL: JUDGE MOIRA MACMILLAN
Determined on the papers, the Tribunal sitting in Chambers on 26 March 2020
© CROWN COPYRIGHT 2019
DECISION
1. The appeal is dismissed.
2. The Appellant is liable to pay the ‘tier 1’ fee of £40 due on 16 July 2018.
3. The Penalty Notice dated 20 September 2019 is confirmed.
REASONS
Background to Appeal
4. The Appellant is a data controller within the meaning of the Data Protection Act
20181 (“DPA”). As such, he is required to comply with the Data Protection (Charges
and Information) Regulations 2018 (“the Regulations”)2. As a “tier 1” organisation, the
Appellant’s fee was £40 .
5. The Appellant failed to provide the Respondent with the information required by
regulation 2 (3) of the Regulations or to pay to the Respondent the Data Protection Fee
required by regulation 2 (2) of the Regulations by the compliance date of 16 July 2018.
6. The Respondent served a Notice of Intent on 3 April 2019 and, in the absence of
any representations from the Appellant, served a Penalty Notice of £400 on 20
September 2019.
7. The Appellant has appealed to this Tribunal on the basis that his default was an
innocent mistake. He asks that the penalty be revoked by the Tribunal.
Appeal to the Tribunal
8. The Appellant’s Notice of Appeal dated 30 September 2019 relies on grounds
that he believed he could end the requirement to pay a registration fee by simple
choosing not to respond to the reminders sent by the Respondent and Notice of Intent.
The Appellant states that he failed to read all of the correspondence sent to him. He
submits that he has difficulties reading, communicating and making budgeting decision,
and has produced the first page of a benefit entitlement letter in support of this.
9. The Appellant further submits that he is a self-employed counsellor but believes
that he is not required to pay a fee on his own behalf. He believes his requirement to
1
http://www.legislation.gov.uk/ukpga/2018/12/contents
2
The Regulations were made under s. 137 DPA. See
http://www.legislation.gov.uk/uksi/2018/480/contents/made
2
register as a data controller arose from his work for Surry Drug and Alcohol Care Ltd.
He states that, at the time the fee was due, he was not sure that his income from this
work would continue because future funding of the charity was uncertain.
10. The Respondent’s Response dated 29 October 2019 resists the appeal. She
submits that the Penalty regime has been established by Parliament and that there is no
requirement to issue reminders (although a reminder was fact been sent in this case). It
is accepted that the Appellant’s failure to comply with the Regulations was due to an
oversight, but it is submitted that the imposition of a Penalty was appropriate in all the
circumstances. The Respondent notes that the Appellant had been a data controller
prior to the commencement of the Regulations and had paid the relevant fees under the
earlier legislation so should have had relevant administrative systems in place.
11. The Respondent submits that, in addition to working for the charity, the Appellant
offers counselling through ‘The Wilbury Clinic’. The Respondent has produced a
webpage that shows the Appellant offers a counselling service directly to members of
the public. It is submitted that the Appellant must receive personal data though this
work as a counsellor and that he is therefore required to pay the fee. The Respondent
submits that the level of penalty is appropriate, and that the Appellant has not provided
a full picture of his financial circumstances, so as to support an argument of undue
hardship.
12. The parties and the Tribunal agreed that this matter was suitable for determination
on the papers in accordance with rule 32 of The Tribunal Procedure (First-tier Tribunal)
(General Regulatory Chamber) Rules 2009, as amended. The Tribunal considered an
agreed open bundle of evidence comprising 54 pages.
The Law
13. Under s, 6 DPA and Article 4(7) of GDPR, a ‘data controller’ is “the natural or
legal person, public authority, agency or other body which, alone or jointly with others,
determines the purposes and means of the processing of personal data.” Personal data
in this context includes names, telephone numbers and email addresses.
14. The Regulations came into force on 25 May 2018. They replace the previously
applicable regulations, made in 2000. Regulation 2 requires a data controller to pay an
annual charge to the Information Commissioner (unless their data processing is
exempt). It also requires the data controller to supply the Information Commissioner
with specified information so that she can determine the relevant charge, based on
turnover and staff numbers.
15. A breach of the Regulations is a matter falling under s. 149 (5) of the DPA.
Section 155 (1) of the DPA provides that the Information Commissioner may serve a
Penalty Notice on a person who breaches their duties under the Regulations. S. 158 of
the DPA requires the Information Commissioner to set a fixed penalty for such a breach,
which she has done in her publicly-available Regulatory Action Policy3. The specified
3
https://ico.org.uk/media/about-the-ico/documents/2259467/regulatory-action-policy.pdf
3
penalty for a tier 1 organisation which breached regulation 2(2) is £400. The statutory
maximum penalty is £4,350, which will be appropriate where there are aggravating
factors.
16. Schedule 16 to the DPA makes provision as to the procedure for serving Penalty
Notices, which includes the service of a Notice of Intent written inviting
representations.
17. An appeal against a Penalty Notice is brought under s. 162(1)(d) DPA. S.162(3)
DPA provides that “A person who is given a penalty notice or a penalty variation notice
may appeal to the Tribunal against the amount of the penalty specified in the notice,
whether or not the person appeals against the notice.”
18. The jurisdiction of the Tribunal is established by s. 163 DPA, as follows:
163 Determination of appeals
(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under
section 162(1) or (3).
(2) The Tribunal may review any determination of fact on which the notice or
decision against which the appeal is brought was based.
(3) If the Tribunal considers—
(a) that the notice or decision against which the appeal is brought is not in
accordance with the law, or
(b) to the extent that the notice or decision involved an exercise of discretion by
the Commissioner, that the Commissioner ought to have exercised the discretion
differently,
the Tribunal must allow the appeal or substitute another notice or decision which
the Commissioner could have given or made.
(4) Otherwise, the Tribunal must dismiss the appeal.
…
19. 1 note that the burden of proof in satisfying the Tribunal that the Commissioner’s
decision was wrong in law or involved an inappropriate exercise of discretion rests with
the Appellant.
20. It is increasingly common for the General Regulatory Chamber to determine
appeals against financial penalties imposed by civil regulators. In appeals against Fixed
Penalty Notices issued by the Pensions Regulator, tribunal judges have frequently
adopted the approach of asking whether a defaulting Appellant has a “reasonable
excuse” for their default, notwithstanding the fact that this concept is not expressly
referred to in the legislation. This approach was approved by the Upper Tribunal in
4
The Pensions Regulator v Strathmore Medical Practice [2018] UKUT 104 (AAC).4
There is much case law concerning what is an is not a “reasonable excuse” and it is
inevitably fact-specific. An oft-cited definition is the one used by the VAT Tribunal
(as it then was) in The Clean Car Company v HMRC (LON/90/1381X) as follows:
“…the question of whether a particular trader had a reasonable excuse should
be judged by the standards of reasonableness which one would expect to be
exhibited by a taxpayer who had a responsible attitude to his duties as a taxpayer,
but who in other respects shared such attributes of the particular appellant as the
tribunal considered relevant to the situation being considered. Thus though such
a taxpayer would give a reasonable priority to complying with his duties in
regard to tax and would conscientiously seek to ensure that his returns were
accurate and made timeously, his age and experience, his health or the incidence
of some particular difficulty or misfortune and, doubtless, many other facts, may
all have a bearing on whether, in acting as he did, he acted reasonably and so
had a reasonable excuse….”
The Facts
21. There appears to be some dispute between the parties as to the facts in this case.
The Appellant implicitly accepts that he received the relevant Notices, although he
initially told the Respondent that he had not received the Notice of Intent. However, the
Appellant does not accept that he was in breach of his legal obligations under the
Regulations on the relevant date.
22. The Appellant has provided corroborating evidence in the form of the Notice of
Intent, which he states ‘hides’ the information about a Fixed Penalty on the 3rd page.
He says he did not read that far. The Appellant has also provided the first page of a
letter from DWP dated 16 July 2019, which is explains that his award of PIP is coming
to an end. The letter does not explain the basis upon which PIP was previously awarded,
but the Appellant has explained this was for reasons of difficulties with communication,
reading and budgeting.
23. The Appellant has provided copies of his invoices to Surrey Drug and Alcohol
Card Ltd for July and August 2019. These are for fees of £133.40 and £156.48
respectively. He has also provided a partially dated email from the charity which refers
to potential funding problems. He submits that the Fixed Penalty of £400 is the
equivalent of 2 months’ salary. He has also provided a page from the ICO website
which he submits demonstrates that he is not a data controller.
24. The Respondent has provided the Tribunal with copies of an email reminder sent
to the Appellant on 16 June 2018, a reminder sent by post on 24 August 2018, and of
the Notice of Intent and Fixed Penalty Notice. The Respondent has also provided a copy
4
https://assets.publishing.service.gov.uk/media/5acf131ee5274a76be66c11a/MISC_3112_2017-00.pdf
5
of a webpage for The Wilbury Clinic, upon which the Appellant advertisers his services
as a counsellor directly to members of the public.
Conclusion
25. I have considered whether the Appellant is a data controller as defined in s. 6
DPA ad article 4(7) GDPR. I conclude that the Appellant is a data controller, since his
activities as a counsellor must involve activity which, ‘[either] alone or jointly with
others, determines the purposes and means of the processing of personal data.’
26. I have considered whether the Appellant has advanced a reasonable excuse for
his failure to comply with the Regulations. I conclude that he has not. I conclude that
a reasonable data controller would have read all relevant correspondence in order to
establish what action to take in order to cancel their registration. Although the Appellant
has explained his difficulties with some aspects of communicating, reading and
budgeting, I conclude that such difficulties should not prevent a reasonable data
controller from either taking the required steps themselves or by establishing systems
that ensures responsibilities are met.
27. I have considered the Appellant’s submission that the information about the Fixed
Penalty was on the 3rd page of the Notice of Intent. I find that a reasonable data
controller would have read all of the information, or would have sought assistance from
someone without the same difficulties. I have also noted the clearly explained
requirement, set out on the 1st page of the Notice of Intent, that the Appellant must
either pay the fee or contact the ICO to explain why the fee should not be paid.
28. I have considered whether there is any basis for departing from the Respondent’s
policy as to the imposition of a £400 fixed fee in the circumstances of this case. I find
that there is not, since the Appellant was sent the information required but failed to take
the required action.
29. Having regard to the relevant principles, I note that the Appellant has presented
some evidence of financial hardship which could affect the penalty. However, he has
only presented evidence of his earnings from working for Surrey Drug and Alcohol
Care Ltd. He has not provided evidence of his earning from other employment such as
The Wilbury Clinic, or of his finances circumstances overall. I therefore find that this
is insufficient evidence of financial hardship in this case.
30. I see no reason to depart from the Respondent’s assessment of the appropriate
penalty.
31. For all these reasons, the appeal is now dismissed and the Penalty Notice is
confirmed.
(Signed)
6
JUDGE MOIRA MACMILLAN DATE: 26 March 2020
DATE PROMULGATED: 27 March 2020
7