FIRST-TIER TRIBUNAL
GENERAL REGULATORY CHAMBER
(INFORMATION RIGHTS)
[2021] UKFTT 0083 (GRC)
Appeal Number: EA/2020/0359/FP (V)
Heard using Could Video Platform
12 March 2021
Before
UPPER TRIBUNAL JUDGE O’CONNOR
Between
TICKETMASTER UK LIMITED
Applicant
and
THE INFORMATION COMMISSIONER
Respondent
Representation
For the Applicant: Ms. A Proops QC and Mr. R Hopkins of Counsel,
instructed by Paul Hastings (Europe) LLP
For the Respondent: Mr T Pitt-Payne QC and Mr S Kosmin of Counsel
DECISION ON THE APPLICANT’S APPLICATION FOR
A STAY OF THE PROCEEDINGS
1
Appeal Number: EA/2020/0359/FP
Preamble
1. The hearing took place remotely, using the Cloud Video Platform. Both parties
were able to fully participate in the half day hearing, and no technical difficulties
affecting the fairness of the proceedings arose.
2. At the outset, I wish to extend my gratitude to the parties for the substantial
assistance that was provided to the Tribunal.
Application
3. By way of an application dated 11 December 2020 (drawn by Ms Proops QC, Mr
White QC and Mr Hopkins of Counsel), the applicant applies to the First-tier
Tribunal (“the Tribunal”) to exercise its power under rule 5(3)(j) of the Tribunal
Procedure (First Tier Tribunal) (General Regulatory Chamber) Rules 2009 (“the
2009 Rules”) to stay the proceedings in the Tribunal “until judgment has been
handed down in the High Court proceedings”. The terms of the order sought has
subsequently undertaken a slight mutation such that the Tribunal was ultimately
invited to “order that the Appeal be stayed until 28 days after judgment is handed down
in the High Court Proceedings”
Factual Background – A Summary
4. The applicant is a company that operates websites on which individuals can buy
tickets for a range of events, such as theatre, concerts, and sporting events. On
13 November 2020, the respondent issued a Penalty Notice against the applicant.
The applicant has brought an appeal against such notice, to the Tribunal. There
are also proceedings in the High Court which arises out of the same incident that
led to the issuing of the Penalty Notice.
The incident giving rise to the Penalty Notice
5. In order to set the scene, I draw the following from the witness statement of Mr
Jack Thorne, a Senior Associate in the London Office of the solicitors’ firm
representing the applicant, which is dated 21 February 2021 and has been drawn
for the purposes of the instant application.
6. There may be some dispute over the underlying factual matrix, both before this
Tribunal and in the High Court, but I need not resolve any such dispute for the
purposes of determining the instant application and nothing in this decision
should be taken as this Tribunal making a finding of fact in relation thereto:
“5. On 23 June 2018, Ticketmaster discovered that a chatbot software tool supplied by,
and solely in the control of, a third-party supplier, Inbenta Technologies Inc.
(“Inbenta”), had been infected with malicious code by unknown criminal
attacker(s), which was then deployed to customers visiting certain
2
Appeal Number: EA/2020/0359/FP
Ticketmaster websites (the “Incident”). I refer to the chatbot software tool
provided by Inbenta as the “Inbenta Chatbot”.
6. The Inbenta Chatbot was deployed on certain Ticketmaster websites for customer
support purposes, but was exclusively hosted and served from Inbenta’s servers. The
Incident involved a novel attack vector, by which the malicious code was inserted
into the Inbenta Chatbot, thereby enabling the attacker(s) to unlawfully scrape or
skim data directly from a customer’s browser session. The Incident did not
involve any compromise of Ticketmaster’s own systems or of any personal
data that was being processed by Ticketmaster (or Inbenta).
7. Following discovery of the Incident on 23 June 2018, Ticketmaster promptly disabled
the Inbenta Chatbot. [On the same date] It informed potentially affected
customers and notified the ICO. The ICO commenced a formal regulatory
investigation into the Incident, with which Ticketmaster cooperated and
assisted. “
7. The respondent summarises the Incident thus, at [12] of her skeleton argument:
“The circumstances are summarised at §3.29 of the Notice. Ticketmaster contracted
with Inbenta Technologies Limited (“Inbenta”) for Inbenta to provide a chatbot for the
Ticketmaster websites; this was designed to interpret user questions, and
automatically identify relevant information. The JavaScript for the chatbot was
hosted on the Inbenta server. Ticketmaster decided to include the chatbot on various
pages of its website, including the payment page. An attacker inserted malicious
code into the JavaScript for the chat bot; this code “scraped” user-inputted
personal data (i.e. it collected the data in order to send it back to the attacker).
Because Ticketmaster included the chatbot on its payment page, the personal
data scraped by the malicious code included financial data such as names,
payment card numbers, expiry dates, and CVV numbers.”
The Penalty Notice
8. As identified above, on 13 November 2020 the respondent issued a Penalty
Notice (“the Notice”) against the applicant in the sum of £1.25 million, such
Notice being issued pursuant to section 155 and schedule 16 to the Data
Protection Act 2018 (“the 2018 Act”). The Penalty Notice arose out of what the
respondent concluded were infringements of Articles 5(1)(f) and 32 of the
General Data Protection Regulations (“the GDPR”) by the applicant between (at
least for the purposes of the Notice) 25 May 2018 and 23 June 2018.
9. Section 6 of the Notice sets out the respondent’s findings as to breach. In
summary she concluded that: (i) implementing third party JavaScripts into web
pages that process personal data, such as payment pages, was a known security
risk at the relevant time (Notice, §6.15-6.16) (ii) in breach of GDPR Articles 5(1)(f)
and 32, the applicant failed to put in place appropriate measures to negate the
risk of third party scripts infecting the chat bot on the payment page of the
applicant’s website (Notice, §6.21) and (iii) in various detailed respects, the
3
Appeal Number: EA/2020/0359/FP
applicant failed adequately to address: (a) the security of the Inbenta chat bot;
(b) the implementation of the Inbenta chat bot into the applicant’s own
infrastructure; and, (c) on-going verification that security was being achieved to
an acceptable level (Notice, §§6.21- 6.26).
The appeal to the First-tier Tribunal
10. On 11 December 2020, the applicant appealed to the Tribunal against the Notice
and made the instant application. The applicant’s grounds of appeal are
comprehensive, running to 21 pages. I have considered the terms of the grounds
carefully and in full. In her skeleton argument, drawn for the purposes of the
instant hearing, the respondent succinctly summarises those grounds in the
following terms [15]:
“(1) Ticketmaster did not breach its obligations under GDPR Articles 5(1)(f) and 32.
(2) The Incident resulted from:
(a) An unforeseen and unforeseeable (by Ticketmaster) criminal attack on
Inbenta;
(b) Inbenta’s failures to maintain appropriate security; and
(c) Inbenta’s false and misleading assurances as to the security of its software.
(3) Any contraventions by Ticketmaster do not justify the imposition of a
monetary penalty.
(4) Alternatively, the penalty imposed was excessive.”
The High Court proceedings
11. There are also ongoing proceedings relating to the Incident in the Chancery
Division of the High Court (Case reference No. BL-2019-LIV-000007). The
proceedings are described in detail in Mr. Thorne’s statement, which exhibits the
pleadings and other relevant documents. The Main Action (Jack Collins and
Others v Ticketmaster UK Limited) is a group action by 795 Ticketmaster
customers who allege that their personal data was compromised as a result of
the Incident. This was commenced on 3 April 2019. The pleadings stage of the
Main Action closed on 28 February 2020.
12. There is also a Part 20 Action (Ticketmaster UK Limited v Inbenta Technologies
Inc) in which the applicant seeks damages and an indemnity and/or
contribution under the Civil Liability (Contribution) Act 1978 against Inbenta; in
turn, Inbenta has brought a counterclaim against the applicant for alleged breach
of certain obligations which it says the applicant owed Inbenta under the
4
Appeal Number: EA/2020/0359/FP
agreement between them regarding the chatbot. The Court has directed that the
Main and Part 20 Actions are to be tried and case managed together. The
pleadings stage of the Part 20 Action closed on 22 June 2020. The disclosure
process is currently ongoing and is due to be completed by 1 April 2021.
Directions for trial are expected to be given at a Case Management Conference
listed on 20 September 2021. The applicant estimates that the trial could take
place around September 2022.
13. The issues before the High Court, at least insofar as they are said to be relevant
to the instant matters, are summarised thus by Mr Thorne in his statement, at
[33]:
“a) Ticketmaster’s vetting of Inbenta, including the weight to be given to the fact that
Inbenta was ISO 27001 certified (see, for example, paragraph 17 of the issues
in the Main Action at page 24);
(b) the respective responsibilities of Ticketmaster and Inbenta for ensuring the security
of the Inbenta Chatbot (see, for example, paragraph 19 of the issues in the
Main Action at page 25 and paragraphs 1 to 7 and 11 of the issues in the Part
20 Action at pages 29 – 30 and 32);
(c) Inbenta’s awareness that the Inbenta Chatbot was being deployed on the payment
pages of Ticketmaster’s websites (see, for example, paragraph 9 of the issues in the
Part 20 Action at page 31);
(d) whether the use of third party JavaScript on websites, including on payment pages,
was a common industry practice at the relevant time and was otherwise
reasonable in all the circumstances (see, for example, paragraph 7 of the
issues in the Main Action at page 20);
(e) whether Ticketmaster was required to abide by PCI-DSS requirements when
deploying the Inbenta Chatbot on the payment pages of its websites (see, for
example, paragraph 17 of the issues in the Main Action at page 24 and
paragraph 20 of the issues in the Part 20 Action at page 35);
(f) the reasonableness of Ticketmaster not deploying sub-resource integrity monitoring,
iFrames or the local hosting of the Inbenta Chatbot software (see, for example,
paragraph 8 of the issues in the Main Action at pages 20 - 21);
(g) the nature and relevance of Monzo’s notifications to Ticketmaster about possible
security issues with the Inbenta Chatbot and Ticketmaster’s actions in
response to those notifications (see, for example, paragraph 9 of the issues in
the Main Action at page 21 and paragraph 14 of the issues in the Part 20
Action at pages 32 - 33);
(h) the nature and relevance of the Twitter messages relied upon by the ICO in the Notice
and the actions of Ticketmaster and Inbenta in response to those messages (see, for
example, paragraph 9 of the issues in the Main Action at page 21 and paragraph 15
5
Appeal Number: EA/2020/0359/FP
of the issues in the Part 20 Action at pages 33 - 34));
(i) the nature and relevance of the concerns that were raised with Inbenta by a third
party, on or by 20 February 2018, about the presence of malicious code on Inbenta’s
servers, and Inbenta’s actions in response to those concerns (see, for example,
paragraph 15 of the issues in the Part 20 Action at pages 33 - 34); and
(j) the cause(s) and nature of the Incident, including the extent to which it entailed a
novel attack vector that could not reasonably have been foreseen by
Ticketmaster in the circumstances (see paragraphs 1 to 6 and 18 and 19 of the
issues in the Main Action at pages 19 – 20 and 25 and paragraphs 16, 17 and
23 of the issues in the Part 20 Action at pages 34 and 37).”
Legal principles
14. The Tribunal has power to stay proceedings under its case management powers
- rule 5(3)(j) of the 2009 Rules. Pursuant to rule 2(3)of the 2009 Rules the Tribunal
must, when exercising its powers, seek to give effect to the overriding objective
set out in rule 2, namely, to deal with cases fairly and justly. Rule 2 materially
reads:
“2 (1) The overriding objective of these Rules is to enable the Tribunal to deal with
cases fairly and justly.
(2) Dealing with a case fairly and justly includes—
(a) dealing with the case in ways which are proportionate to the importance of the
case, the complexity of the issues, the anticipated costs and the resources of
the parties;
(b) avoiding unnecessary formality and seeking flexibility in the proceedings;
(c) ensuring, so far as practicable, that the parties are able to participate fully in
the proceedings;
(d) using any special expertise of the Tribunal effectively; and
(e) avoiding delay, so far as compatible with proper consideration of the issues.
(3) The Tribunal must seek to give effect to the overriding objective when it— (a)
exercises any power under these Rules … …”.
15. There is no dispute as between the parties as to the appropriate legal principles
to be applied to a determination of an application for a stay of proceedings in
circumstances such as those which prevail in the instant matter. The principles
relied upon by the parties are identified in the decision of the Inner House of the
Court of Session in Revenue and Customs Commissioners v RBS Deutschland
Holdings GmbH [2007] STC 814 (“the RBS case”), and have been consistently
applied in First-tier Tribunal (Tax Chamber).
6
Appeal Number: EA/2020/0359/FP
16. The RBS case involved an appeal by a company (RBS) concerned in the provision
of banking and leasing services from premises in Germany, against an
assessment of income tax. The Commissioners for Her Majesty's Revenue and
Custom applied to the VAT and duties tribunal to sist proceedings in so far as
they related to their contention that RBS's actions had amounted to an abuse of
rights, pending a decision of the European Court of Justice on the applicability
of this doctrine in the field of VAT. The tribunal declined to sist any part of the
appeal, having considered the Advocate General's opinion. The decision was
quashed by the Inner House, which granted a sist of proceedings to the extent
sought by the Commissioners. In doing so Lord Osborne, delivering the
judgment of the Court, stated as follows at [22]:
“…a tribunal or court might sist [i.e. stay] proceedings against the wish of a party
if it considered that a decision in another court would be of material assistance in
resolving the issues before the tribunal or court and that it would be expedient to
do so”
17. The decision in RBS is not strictly binding on me, nor are any of the cited
decisions from the First-tier Tribunal adopting the ratio of RBS.
18. In his skeleton argument, Mr Pitt-Payne QC referred to a number of authorities
from the Senior Courts applying the Civil Procedure Rules in applications
concerning stays, but accepted in his oral submissions that in referring to such
decisions he was not seeking to persuade the Tribunal to adopt a different
threshold to that identified in RBS.
19. It seems to me though, that the dual considerations of material assistance and
expediency, identified in RBS, are simply a rewrapping of the overriding objective
identified in rule 2 of the 2009 Rules, which the Tribunal must apply to its
considerations in any event. The phraseology of ‘material assistance’ and
‘expediency’ logically reflect those matters to which due weight should be
attached but, ultimately, the Tribunal must ensure that each case is dealt with
fairly and justly.
20. The issue of staying proceedings was the subject of consideration by the Court
of Appeal in AB (Sudan) v Secretary of State for the Home Department [2013]
EWCA Civ 921. At [26] the Court cited with approval the Upper Tribunal’s
formulation of the following governing principles:
"27. A stay on proceedings may be associated with the grant of interim relief, but
it is essentially different. In determining whether proceedings should be
stayed, the concerns of the court itself have to be taken into the balance.
Decisions as to listing, and decisions as to which cases are to be heard at any
particular time are matters for the court itself and no party to a claim can
demand that it be heard before or after any other claim. The court will want
7
Appeal Number: EA/2020/0359/FP
to deal with claims before it as expeditiously as is consistent with justice.
But, on the other hand, it is unlikely to want to waste time and other valuable
resources on an exercise that may well be pointless if conducted too soon. If,
therefore, the court is shown that there will be, or there is likely to be, some
event in the foreseeable future that may have an impact on the way a claim
is decided, it may decide to stay proceedings in the claim until after that
event. It may be more inclined to grant a stay if there is agreement between
the parties. It may not need to grant a stay if the pattern of work shows that
the matter will not come on for trial before the event in question. The starting
point must, however, be that a claimant seeks expeditious determination of
his claim and that delay will be ordered only if good reason is shown.”
The submissions - a summary
21. The reasons advanced by the applicant for a stay of the proceedings in the
Tribunal to await the judgment in the High Court proceedings can be
summarised thus:
(a) Resolution of the in-principle question of whether the applicant can be
held liable in respect of the Incident has extremely significant
consequences for the applicant. Justice demands that the liability issues
are addressed through a particularly thorough litigation process,
where all the relevant evidence can be properly identified, ventilated,
and thoroughly assessed. The High Court is better placed to adjudicate
on the issue of liability, given that its rules and practices are far more
conducive to achieving the thoroughness of approach that is
warranted in this case.
(b) The High Court, which is the superior court, was seized by the liability
issue before the appeal in the Tribunal commenced and indeed before
the Notice was issued.
(c) There is a very considerable overlap between the two sets of
proceedings and a determination of the liability issue by the High
Court would be very likely to dispose of the liability issue as it arises
in the appeal. Even if that very likely outcome did not eventuate, the
High Court’s judgment would likely narrow very substantially the live
liability issues in the Appeal, thus saving costs for the parties and
conserving judicial resources.
(d) If a stay is refused, that would inevitably create the risk of conflicting
determinations by the High Court and the Tribunal on the same points.
This is contrary to the applicant’s interests, and the wider public
interest. The question of how the data security obligations provided for
under the GDPR are to be construed and applied by the courts in a
8
Appeal Number: EA/2020/0359/FP
cyber-attack case is an important question which, to date, has not been
subject to any reasoned judicial analysis, whether by the Courts or by
the Tribunal. It would be wholly unsatisfactory, therefore, for
conflicting judgments to emerge in the applicant’s case.
(e) Injustice and unfairness would result if the applicant were required to
conduct two sets of heavy and substantially overlapping proceedings
in tandem. This would be very costly, oppressively burdensome and
extremely difficult for the applicant to manage. This may also prove
seriously disruptive to one or both litigation processes.
(f) A stay would also ensure that public resources – specifically those of
the Tribunal and/or the High Court, and the resources of the
respondent – are not wasted on duplicative proceedings.
22. In outline, the respondent’s position is that the following compelling reasons
support the contention that a stay should not be granted:
(a) The grant of a stay should be the exception, rather than the norm: the
applicant has not demonstrated that the circumstances are exceptional
so as to justify a stay, put forward “solid grounds” in support of the
stay, or shown that the circumstances are “rare and compelling”.
(b) There would be a delay of at least 3 years or more from now before the
Appeal was heard.
(c) The respondent is not a party to the High Court proceedings, and so
those proceedings would not give rise to any issue estoppel in the
appeal before the Tribunal. The High Court judgment would bind the
Tribunal in relation to matters of law, but not as to issues of fact.
(d) The High Court proceedings will not provide material assistance to the
Tribunal. First, the application provides little detail as the issue of law
that is said to arise relating to the correct approach to GDPR Article
5(1)(f). Second, the way in which the case as to breach is framed in the
appeal and in the High Court proceedings is not identical. The appeal
is focused on the way in which the respondent has formulated the
allegations of breach in the Notice, while the High Court proceedings
are focused on the way in which those issues have been framed in the
pleadings. Third, there are a number of matters raised in the grounds
to the Tribunal that will not be addressed by a judgment of the High
Court.
(e) Should either the Main Action or the Part 20 Action be settled, the stay
will not achieve its asserted benefit, namely, to resolve issues before the
9
Appeal Number: EA/2020/0359/FP
that the High Court proceedings will go to trial but be disposed of in a
judgment that will not address the full scope of the issues pleaded that are
material to the Tribunal on this Appeal. There must be a real prospect
of settlement of some part or all of the High Court proceedings. There
is also a realistic possibility appeal.
(f) There is a strong likelihood that the grounds of appeal to the Tribunal
will be materially amended following the High Court decision, which
will leave the respondent not knowing the full extent of the applicant’s
case for another two years.
(g) The anticipated delay in the hearing of this Appeal (i.e. to early 2024)
would materially prejudice the respondent’s ability to address the
relevant matters in evidence, and hence the Tribunal’s ability fairly to
determine those matters.
(h) The First-tier Tribunal (and the Upper Tribunal) have been designated
by statute as the specialist tribunals for data protection regulation. The
Stay Application, asserts (without explanation) that it is preferable for
the High Court to decide the issues of law relevant to this Appeal.
Were the Stay Application (and comparable future applications in
similar circumstances) to be granted, legal principles relevant to data
breach cases would be developed by the High Court and the role of the
specialist tribunals would be significantly constrained. Such an
approach would undermine Parliament’s intention when establishing
specialist tribunals to hear appeals of this nature.
Discussion
23. The determination of the instant stay application requires an exercise of
balancing the ingredients enshrined in the overriding objective: managing the
interface and overlap between two judicial organisations, the avoidance of
excessive cost, the right of every litigant to expeditious justice, the minimising
of litigation delays, the allocation of limited judicial resources and, broadly, the
convenience of all concerned. The striking of the balance is delicate and intensely
fact sensitive. As indicated above, I am satisfied that the dual considerations of
‘material assistance’ and ‘expediency’ traverse the same territory as applying
rule 5(3)(j) of the 2009 Rules though the prism of rule 2 thereof. However, out of
deference to the way in which the case has been put, and responded to, by the
parties I will follow the well-trodden path of the First-tier Tribunal (Tax
Chamber) in adopting the ‘material assistance’ and ‘expediency’ considerations.
I confirm, however, that the same conclusion is reached on a proper application
of rules 5(3)(j) and rule 2 of the 2009 Rules.
10
Appeal Number: EA/2020/0359/FP
24. A number of the aforementioned ingredients combine to lead to the expectation
that delay will be ordered by the Tribunal only if good reason is shown. The
granting of a stay is the exception not the norm. That is not to put in place a legal
threshold of exceptionally, but rather it is the expression of an expectation that a
proper and robust application of the relevant principles is likely to lead to the
granting of a stay in only a small minority of cases, identifiable on a case by case
basis.
25. In this matter, having carefully considered the competing submissions, I accept
that it is likely, although by no means inevitable, that the Tribunal will be
materially assisted by a substantive judgment in the High Court proceedings.
26. Mr Pitt-Payne accepted there to be a “material overlap” in the two sets of
proceedings, albeit to a limited extent, when in oral submissions he travelled
through issues 7, 8, 9 and 17 in the High Court proceedings, though also
observing that the issues were raised in significantly more detail in the Notice.
27. Having observed the extent of the overlap between the proceedings, Mr Pitt-
Payne submitted that it was not safe to assume that all of the specific points relied
upon by the respondent in the Notice would be raised by the parties in the High
Court proceedings. I accept that this is so. I also accept, as Mr Pitt-Payne
observed, that there is no identity of parties as between the two sets of
proceedings and that the focus of the two sets of proceedings is different because
there is a different litigation context and different drivers of the litigation issues.
Nevertheless, on my analysis of the issues, there is a substantial overlap in the
fundamental factual and legal building blocks required to reach a resolution in
each of the proceedings. The issues in both sets of proceedings are rooted in the
fundamental question of whether there has been a breach of Article 5(1)(f) GDPR,
and the High Court’s conclusions and reasons in relation to such question are in
my view likely to be of material assistance to the Tribunal.
28. Mr Pitt-Payne is, of course, correct in his assertion that any findings of fact made
by the High Court will not, for the reasons he gives, be binding on the Tribunal.
However, on the information currently before me, I accept the applicant’s
submission that it is likely that such findings, although not binding, will
materially assist the Tribunal in its fact finding exercise.
29. To my mind, it is highly relevant that Inbenta are a party to the High Court
proceedings and that, as a consequence, the High Court will receive direct
evidence from Inbenta in relation to the Incident. The applicant’s evidence to the
High Court will no doubt also be tested by Inbenta. Inbenta play a central role in
the Incident and it is likely that its evidence will be of some, if not great, value in
ensuring that the underlying factual matrix is justly established. In contrast,
Inbenta is not currently a party to the Tribunal proceedings, and neither party
11
Appeal Number: EA/2020/0359/FP
has suggested that an application is likely to be made which changes this
position.
30. I further accept Ms Proops’ contention that there is a reasonable prospect of
Tribunal being materially assisted by conclusions of the High Court on common
issues of law; indeed, as the parties accept, the Tribunal would be bound by the
High Court’s conclusions on matters of law where there is no higher authority
on the point. I further accept Ms Proops’ submission that, at least as matters are
currently formulated, an issue of law upon which there is as yet no legal
authority is likely to loom large in both sets of proceedings i.e. the proper
approach to the application of Article 5(1)(f) GDPR in a cyber security case and,
in particular, in circumstances where the data controller did not process the
personal data that was compromised. In weighing this feature into my
overarching considerations, I have taken account of the fact that the question as
to whether the applicant processed the data is a matter of disputed fact.
31. In considering the weight to be attached to the dual features of the likely factual
and legal assistance to be gained by the Tribunal from the High Court judgment,
I have taken full account of the difference in emphasis of the two sets of
proceedings, that the High Court proceedings will not consider or determine all
of the matters by reference to which the respondent reached her findings as to
breach, and that there are issues raised in the grounds of appeal which are
unlikely to be directly addressed in the High Court proceedings. As already
indicated, however, I find that it is likely that the Tribunal will be materially
assisted by the judgment of the High Court.
32. Moving on, having first observed that the Tribunal is a specialist Tribunal, Mr
Pitt-Payne asserted that it was Parliament’s intention that the Tribunal resolve
issues of law and fact in the field of data protection regulation. The instant
application, he submits, “…raises issues of wide ranging importance about the
respective roles of the Tribunal and the High Court…were stays to be regularly granted
in cases of this nature it would undermine Parliament’s intention when establishing
specialist tribunals to hear appeals of this nature.” It is asserted that this is “perhaps
the most significant point” in the consideration of whether a stay should be granted
[skeleton argument at paragraph 44].
33. The role of Tribunals as specialists in particular legal regimes is now well
established, as is the proposition that weight ought to be accorded to Tribunal
decisions because they are authored by specialist judges. It is also beyond doubt
that expediency requires that the Tribunal’s expertise “should be used to best effect,
to shape and direct the development of the law and practice” in its specialist field – R
(Jones) v First-tier Tribunal (Social Entitlement Chamber) [2013] 2 AC 48 at [46].
Nevertheless, these are broad and general propositions that must be properly
placed within the context of the fact sensitive and more nuanced exercise that I
am required to undertake. In coming to my conclusions, I have taken account of
12
Appeal Number: EA/2020/0359/FP
the Tribunal’s specialist knowledge and experience, and its role in the sphere of
data protection regulation, but I also observe that data protection regulation is
not a sphere of judicial work which is solely occupied by the Tribunal, as is
evidenced by the High Court proceedings referred to herein.
34. I have further taken account of the fact that resolution of the High Court
proceedings may not ultimately be by way of a substantive judgment, the
consequence of which is that if a stay were to be granted now, there is a risk that
the proceedings in the Tribunal would have been delayed for no good reason.
There is, though, no indication in the papers that such a possibility is anything
other than speculative at the present time.
35. It is also a relevant feature that the respondent is not a party to the High Court
proceedings, so the High Court will be denied the opportunity of having both
the legal and the factual issues tested by the expert regulatory body. It may be
that, as a consequence, the respondent has much to say before the Tribunal about
the legal and factual analysis and conclusions of the High Court, and she would
be entitled to make submissions in this regard, but this does not, in my view,
lead to the conclusion that the judgment of the High Court will not be of material
assistance to the Tribunal.
36. Turning to other issues, that the parties chose to pigeon-hole within the
consideration of expediency. At the forefront, is the issue of the delay which will
be caused to the Tribunal proceedings if a stay is granted in the terms sought.
The applicant estimates, and this is not in dispute, that it is likely that a trial date
in the High Court proceedings will be set for around September 2022. It is very
unlikely that in a matter of such complexity the judgment will be delivered ex
tempore, and allowing for a month or so for the judgment to be written is not
unreasonable. The applicant seeks a further 28 days after judgment before the
stay is lifted. This takes us to around December 2022, i.e. around 21 months
hence, before judgment in delivered in the High Court proceedings - a
substantial delay in the Tribunal’s proceedings by any method of calculation. Mr
Pitt-Payne refers also to the possibility of an onward appeal in such proceedings.
I have borne this in mind, but note that the applicant seeks a stay only until 28
days after the date of the handing down of judgment in the High Court
proceedings. The question of an onward appeal is purely speculative at this
stage, as are terms of any grounds of appeal and whether such grounds might
impinge on matters of relevance to this Tribunal. If such an event does eventuate
the parties will no doubt have a full opportunity at the relevant time to make
submissions to this Tribunal as to the proper progress of the instant proceedings.
37. On the basis of the likely timeline for the High Court proceedings, as set out
above, one can realistically envisage a listing date for the appeal in the Tribunal
to be around the late Summer/early Autumn of 2023 – approximately 2½ years
13
Appeal Number: EA/2020/0359/FP
from now, nearly three years after the lodging of the notice of appeal and over
five years after the Incident which led to the issuing of the Penalty Notice.
38. Although this delay is lengthy and, therefore, prima facie a significant factor
weighing against the grant of the stay, it too must be set in context and its
consequences must be thoroughly examined. One relevant consideration is the
length of time between the applicant referring the potential data breach to the
respondent (23 June 2018) and the service of the Penalty Notice by the
respondent (13 November 2020). Whilst I do not accept Ms Proops’ assertion that
the respondent intentionally sought to delay matters prior to the issue of the
Penalty Notice, it is relevant that over two years passed between the applicant’s
self-referral and the Penalty Notice being issued.
39. As to particular prejudice to the respondent arising from the substantial delay if
a stay were to be granted, in his skeleton argument Mr Pitt-Payne put the
respondent’s case thus: the delay “would materially prejudice the Commissioner’s
ability to address the relevant matters in evidence, and hence the Tribunal’s ability fairly
to determine those matter.” At the hearing, Mr Pitt-Payne elucidated to some
extent, observing that the respondent would not, and could not be expected to,
prepare her evidence for another two years or more.
40. This though is not a case which is going to turn on, or indeed feature, evidence
from the Information Commissioner’s Office which relies upon witness memory
or recollection of events. There is, as Mr Pitt-Payne accepted, a paper trail of
information and documentary evidence leading up to the respondent’s decision.
The witness evidence from the respondent will, I have no doubt, be presented
after a careful consideration and analysis of such documentation. I accept that
the evidence will require contextualising and explaining before the Tribunal, but
absent more specific detail, it is difficult to understand why the respondent
would be in a substantially, or even materially, worse position to provide such
evidence in three years’ time than if a stay were not granted and she had to
present it to the Tribunal in six to nine months’ time. In my view, the
respondent’s skeleton argument substantially overstates the prejudice that
would be caused to her ability to properly put her case, by any delay arising from
the granting of a stay.
41. Mr Pitt-Payne further advanced the argument that, as the respondent is assisted
in exercising her enforcement functions by guidance given by the Tribunal (in
doing so, equating the Tribunal’s role to “marking the Commissioner’s homework”)
any substantial delay in the respondent receiving such guidance will
“significantly reduce the benefits of that guidance”. I have trouble understanding
this submission, because the benefits to the respondent will be the same
whenever the guidance is given. I do accept, however, that receiving of such
guidance will self-evidently be delayed if the Tribunal’s decision is delayed. I
also accept that one consequence of this, if the Tribunal were to ultimately
14
Appeal Number: EA/2020/0359/FP
conclude that the respondent had acted erroneously in the instant case, might be
that the respondent proceeds on the same erroneous basis in other cases prior to
the instant ‘guidance’ being received. I have taken this into account in my
considerations.
42. A further concern, raised by the respondent early in the proceedings, was that
the applicant may not be in a position to comply with the Penalty Notice if it is
unsuccessful in the High Court proceedings. This concern has now been
alleviated by Barclays Bank PLC issuing an irrevocable Standby Letter of Credit
in the sum of £1,250,000 to secure fulfilment of the applicant’s obligation to the
respondent in respect of the sum payable under the Penalty Notice.
43. Drawing all of the ingredients together, and having carefully considered the
totality of the submissions made and information provided to me, I conclude
that it would be expedient to grant a stay.
44. In my view, whilst the length of the delay is likely to be substantial, and noting
that the delay strikes against the principles of minimising litigation delays and
that every litigant has a right to expeditious justice, the prejudice caused to the
respondent by such a delay will be minimal. This is to be contrasted with the
significant factual and/or legal assistance likely to be gained by the Tribunal in
awaiting the decision in the High Court. In particular, it is of relevance that the
High Court has, as a party before it, an integral player in the Incident, Inbenta.
This party will not be playing a direct part in the Tribunal proceedings and I
have no doubt that justice will be enhanced in the Tribunal by awaiting a
judgment of the High Court that has considered Inbenta’s evidence and
submissions. In addition, as alluded to above, there is also a novel legal issue
which strides across both sets of proceedings, the High Court’s conclusion in
relation to which will also materially assist the Tribunal.
45. For these reasons, I grant the applicant’s application for a stay of proceedings.
46. I re-iterate, as I have done on numerous occasions above, that this conclusion is
reached on the particular facts of this matter as they currently prevail and as they
have been presented to me. The factual matrix in this case may change, which
may mean that it is no longer appropriate for the stay to remain in place. If that
is so, an appropriate application can be made, and will need to be considered in
light of the facts as they present themselves at that time. In addition, given the
intensely fact specific nature of the enquiry that must be undertaken when an
application for a stay of the proceedings is being considered, it is axiomatic that
the conclusions reached in this matter cannot and should not have any bearing
on the consideration of a stay application made in a different appeal on different
facts.
15
Appeal Number: EA/2020/0359/FP
Decision
The applicant’s application for a stay of proceedings is granted.
The instant proceedings are stayed until 28 days after the handing down of the
judgment in the High Court proceedings, or other event finally disposing of
such proceedings.
Directions
A. By no later than 1 June 2021, the applicant must file with the Tribunal and serve
on the respondent a note detailing the progress of the High Court proceedings,
which must, inter alia, identify any event in those proceedings which is arguably
capable of being material to an assessment of whether the stay in the Tribunal
proceedings should be maintained (hereinafter referred to as “a Note”).
B. Thereafter, the applicant must file a Note with the Tribunal and serve a copy of
the Note on the respondent, no less frequently than the first day of every third
month thereafter, until the handing down of the judgment in the High Court
proceedings or those proceedings are finally disposed of.
C. The applicant must file with the Tribunal and serve on the respondent within
seven days of the document being sealed by the High Court, any document
purporting to dispose of any part of the High Court proceedings. This includes
any accompanying document identifying the reasons for the purported disposal.
D. A case management hearing is to be listed in the Tribunal in the instant appeal
to be heard no later than 28 days after the date on which there is a final disposal
of the proceedings in the High Court, whether that be by way of handing down
of a judgment or otherwise. For the instant purposes, the High Court
proceedings are to be treated as finally disposed of irrespective of whether an
application for permission to appeal has been lodged, or whether time for
lodging such an application has expired.
E. Liberty to apply.
Signed:
M O’Connor
Upper Tribunal Judge O’Connor
Promulgated: 9th April 2021
16