Factual Background - A Summary
4. The applicant is a company that operates websites on which individuals can buy tickets for a range of events, such as theatre, concerts, and sporting events. On 13 November 2020, the respondent issued a Penalty Notice against the applicant. The applicant has brought an appeal against such notice, to the Tribunal. There are also proceedings in the High Court which arises out of the same incident that led to the issuing of the Penalty Notice.
The incident giving rise to the Penalty Notice
5. In order to set the scene, I draw the following from the witness statement of Mr Jack Thorne, a Senior Associate in the London Office of the solicitors’ firm representing the applicant, which is dated 21 February 2021 and has been drawn for the purposes of the instant application.
6. There may be some dispute over the underlying factual matrix, both before this Tribunal and in the High Court, but I need not resolve any such dispute for the purposes of determining the instant application and nothing in this decision should be taken as this Tribunal making a finding of fact in relation thereto:
“5. On 23 June 2018, Ticketmaster discovered that a chatbot software tool supplied by, and solely in the control of, a third-party supplier, Inbenta Technologies Inc. (“Inbenta”), had been infected with malicious code by unknown criminal attacker(s), which was then deployed to customers visiting certain Ticketmaster websites (the “Incident”). I refer to the chatbot software tool provided by Inbenta as the “Inbenta Chatbot”.
6. The Inbenta Chatbot was deployed on certain Ticketmaster websites for customer support purposes, but was exclusively hosted and served from Inbenta’s servers. The Incident involved a novel attack vector, by which the malicious code was inserted into the Inbenta Chatbot, thereby enabling the attacker(s) to unlawfully scrape or skim data directly from a customer’s browser session. The Incident did not involve any compromise of Ticketmaster’s own systems or of any personal data that was being processed by Ticketmaster (or Inbenta).
7. Following discovery of the Incident on 23 June 2018, Ticketmaster promptly disabled the Inbenta Chatbot. [On the same date] It informed potentially affected customers and notified the ICO. The ICO commenced a formal regulatory investigation into the Incident, with which Ticketmaster cooperated and assisted. “
7. The respondent summarises the Incident thus, at [12] of her skeleton argument:
“The circumstances are summarised at §3.29 of the Notice. Ticketmaster contracted with Inbenta Technologies Limited (“Inbenta”) for Inbenta to provide a chatbot for the Ticketmaster websites; this was designed to interpret user questions, and automatically identify relevant information. The JavaScript for the chatbot was hosted on the Inbenta server. Ticketmaster decided to include the chatbot on various pages of its website, including the payment page. An attacker inserted malicious code into the JavaScript for the chat bot; this code “scraped” user-inputted personal data (i.e. it collected the data in order to send it back to the attacker). Because Ticketmaster included the chatbot on its payment page, the personal data scraped by the malicious code included financial data such as names, payment card numbers, expiry dates, and CVV numbers.”
The Penalty Notice
8. As identified above, on 13 November 2020 the respondent issued a Penalty Notice (“the Notice”) against the applicant in the sum of £1.25 million, such Notice being issued pursuant to section 155 and schedule 16 to the Data Protection Act 2018 (“the 2018 Act”). The Penalty Notice arose out of what the respondent concluded were infringements of Articles 5(1)(f) and 32 of the General Data Protection Regulations (“the GDPR”) by the applicant between (at least for the purposes of the Notice) 25 May 2018 and 23 June 2018.
9. Section 6 of the Notice sets out the respondent’s findings as to breach. In summary she concluded that: (i) implementing third party JavaScripts into web pages that process personal data, such as payment pages, was a known security risk at the relevant time (Notice, §6.15-6.16) (ii) in breach of GDPR Articles 5(1)(f) and 32, the applicant failed to put in place appropriate measures to negate the risk of third party scripts infecting the chat bot on the payment page of the applicant’s website (Notice, §6.21) and (iii) in various detailed respects, the applicant failed adequately to address: (a) the security of the Inbenta chat bot; (b) the implementation of the Inbenta chat bot into the applicant’s own infrastructure; and, (c) on-going verification that security was being achieved to an acceptable level (Notice, §§6.21- 6.26).
The appeal to the First-tier Tribunal
10. On 11 December 2020, the applicant appealed to the Tribunal against the Notice and made the instant application. The applicant’s grounds of appeal are comprehensive, running to 21 pages. I have considered the terms of the grounds carefully and in full. In her skeleton argument, drawn for the purposes of the instant hearing, the respondent succinctly summarises those grounds in the following terms [15]:
“(1) Ticketmaster did not breach its obligations under GDPR Articles 5(1)(f) and 32.
(2) The Incident resulted from:
(a) An unforeseen and unforeseeable (by Ticketmaster) criminal attack on Inbenta;
(b) Inbenta’s failures to maintain appropriate security; and
(c) Inbenta’s false and misleading assurances as to the security of its software.
(3) Any contraventions by Ticketmaster do not justify the imposition of a monetary penalty.
(4) Alternatively, the penalty imposed was excessive.”
The High Court proceedings
11. There are also ongoing proceedings relating to the Incident in the Chancery Division of the High Court (Case reference No. BL-2019-LIV-000007). The proceedings are described in detail in Mr. Thorne’s statement, which exhibits the pleadings and other relevant documents. The Main Action (Jack Collins and Others v Ticketmaster UK Limited) is a group action by 795 Ticketmaster customers who allege that their personal data was compromised as a result of the Incident. This was commenced on 3 April 2019. The pleadings stage of the Main Action closed on 28 February 2020.
12. There is also a Part 20 Action (Ticketmaster UK Limited v Inbenta Technologies Inc) in which the applicant seeks damages and an indemnity and/or contribution under the Civil Liability (Contribution) Act 1978 against Inbenta; in turn, Inbenta has brought a counterclaim against the applicant for alleged breach of certain obligations which it says the applicant owed Inbenta under the agreement between them regarding the chatbot. The Court has directed that the Main and Part 20 Actions are to be tried and case managed together. The pleadings stage of the Part 20 Action closed on 22 June 2020. The disclosure process is currently ongoing and is due to be completed by 1 April 2021. Directions for trial are expected to be given at a Case Management Conference listed on 20 September 2021. The applicant estimates that the trial could take place around September 2022.
13. The issues before the High Court, at least insofar as they are said to be relevant to the instant matters, are summarised thus by Mr Thorne in his statement, at [33]:
“a) Ticketmaster’s vetting of Inbenta, including the weight to be given to the fact that Inbenta was ISO 27001 certified (see, for example, paragraph 17 of the issues in the Main Action at page 24);
(b) the respective responsibilities of Ticketmaster and Inbenta for ensuring the security of the Inbenta Chatbot (see, for example, paragraph 19 of the issues in the Main Action at page 25 and paragraphs 1 to 7 and 11 of the issues in the Part 20 Action at pages 29 - 30 and 32);
(c) Inbenta’s awareness that the Inbenta Chatbot was being deployed on the payment pages of Ticketmaster’s websites (see, for example, paragraph 9 of the issues in the Part 20 Action at page 31);
(d) whether the use of third party JavaScript on websites, including on payment pages, was a common industry practice at the relevant time and was otherwise reasonable in all the circumstances (see, for example, paragraph 7 of the issues in the Main Action at page 20);
(e) whether Ticketmaster was required to abide by PCI-DSS requirements when deploying the Inbenta Chatbot on the payment pages of its websites (see, for example, paragraph 17 of the issues in the Main Action at page 24 and paragraph 20 of the issues in the Part 20 Action at page 35);
(f) the reasonableness of Ticketmaster not deploying sub-resource integrity monitoring, iFrames or the local hosting of the Inbenta Chatbot software (see, for example, paragraph 8 of the issues in the Main Action at pages 20 - 21);
(g) the nature and relevance of Monzo’s notifications to Ticketmaster about possible security issues with the Inbenta Chatbot and Ticketmaster’s actions in response to those notifications (see, for example, paragraph 9 of the issues in the Main Action at page 21 and paragraph 14 of the issues in the Part 20 Action at pages 32 - 33);
(h) the nature and relevance of the Twitter messages relied upon by the ICO in the Notice and the actions of Ticketmaster and Inbenta in response to those messages (see, for example, paragraph 9 of the issues in the Main Action at page 21 and paragraph 15 of the issues in the Part 20 Action at pages 33 - 34));
(i) the nature and relevance of the concerns that were raised with Inbenta by a third party, on or by 20 February 2018, about the presence of malicious code on Inbenta’s servers, and Inbenta’s actions in response to those concerns (see, for example, paragraph 15 of the issues in the Part 20 Action at pages 33 - 34); and
(j) the cause(s) and nature of the Incident, including the extent to which it entailed a novel attack vector that could not reasonably have been foreseen by Ticketmaster in the circumstances (see paragraphs 1 to 6 and 18 and 19 of the issues in the Main Action at pages 19 - 20 and 25 and paragraphs 16, 17 and 23 of the issues in the Part 20 Action at pages 34 and 37).”
Legal principles
14. The Tribunal has power to stay proceedings under its case management powers - rule 5(3)(j) of the 2009 Rules. Pursuant to rule 2(3)of the 2009 Rules the Tribunal must, when exercising its powers, seek to give effect to the overriding objective set out in rule 2, namely, to deal with cases fairly and justly. Rule 2 materially reads:
“2 (1) The overriding objective of these Rules is to enable the Tribunal to deal with cases fairly and justly.
(2) Dealing with a case fairly and justly includes—
(a) dealing with the case in ways which are proportionate to the importance of the case, the complexity of the issues, the anticipated costs and the resources of the parties;
(b) avoiding unnecessary formality and seeking flexibility in the proceedings;
(c) ensuring, so far as practicable, that the parties are able to participate fully in the proceedings;
(d) using any special expertise of the Tribunal effectively; and
(e) avoiding delay, so far as compatible with proper consideration of the issues.
(3) The Tribunal must seek to give effect to the overriding objective when it— (a) exercises any power under these Rules … …”.
15. There is no dispute as between the parties as to the appropriate legal principles to be applied to a determination of an application for a stay of proceedings in circumstances such as those which prevail in the instant matter. The principles relied upon by the parties are identified in the decision of the Inner House of the Court of Session in Revenue and Customs Commissioners v RBS Deutschland Holdings GmbH [2007] STC 814 (“the RBS case”), and have been consistently applied in First-tier Tribunal (Tax Chamber).
16. The RBS case involved an appeal by a company (RBS) concerned in the provision of banking and leasing services from premises in Germany, against an assessment of income tax. The Commissioners for Her Majesty's Revenue and Custom applied to the VAT and duties tribunal to sist proceedings in so far as they related to their contention that RBS's actions had amounted to an abuse of rights, pending a decision of the European Court of Justice on the applicability of this doctrine in the field of VAT. The tribunal declined to sist any part of the appeal, having considered the Advocate General's opinion. The decision was quashed by the Inner House, which granted a sist of proceedings to the extent sought by the Commissioners. In doing so Lord Osborne, delivering the judgment of the Court, stated as follows at [22]:
“…a tribunal or court might sist [i.e. stay] proceedings against the wish of a party if it considered that a decision in another court would be of material assistance in resolving the issues before the tribunal or court and that it would be expedient to do so”
17. The decision in RBS is not strictly binding on me, nor are any of the cited decisions from the First-tier Tribunal adopting the ratio of RBS.
18. In his skeleton argument, Mr Pitt-Payne QC referred to a number of authorities from the Senior Courts applying the Civil Procedure Rules in applications concerning stays, but accepted in his oral submissions that in referring to such decisions he was not seeking to persuade the Tribunal to adopt a different threshold to that identified in RBS.
19. It seems to me though, that the dual considerations of material assistance and expediency, identified in RBS, are simply a rewrapping of the overriding objective identified in rule 2 of the 2009 Rules, which the Tribunal must apply to its considerations in any event. The phraseology of ‘material assistance’ and ‘expediency’ logically reflect those matters to which due weight should be attached but, ultimately, the Tribunal must ensure that each case is dealt with fairly and justly.
20. The issue of staying proceedings was the subject of consideration by the Court of Appeal in AB (Sudan) v Secretary of State for the Home Department [2013] EWCA Civ 921. At [26] the Court cited with approval the Upper Tribunal’s formulation of the following governing principles:
"27. A stay on proceedings may be associated with the grant of interim relief, but it is essentially different. In determining whether proceedings should be stayed, the concerns of the court itself have to be taken into the balance. Decisions as to listing, and decisions as to which cases are to be heard at any particular time are matters for the court itself and no party to a claim can demand that it be heard before or after any other claim. The court will want to deal with claims before it as expeditiously as is consistent with justice. But, on the other hand, it is unlikely to want to waste time and other valuable resources on an exercise that may well be pointless if conducted too soon. If, therefore, the court is shown that there will be, or there is likely to be, some event in the foreseeable future that may have an impact on the way a claim is decided, it may decide to stay proceedings in the claim until after that event. It may be more inclined to grant a stay if there is agreement between the parties. It may not need to grant a stay if the pattern of work shows that the matter will not come on for trial before the event in question. The starting point must, however, be that a claimant seeks expeditious determination of his claim and that delay will be ordered only if good reason is shown.”
The submissions - a summary
21. The reasons advanced by the applicant for a stay of the proceedings in the Tribunal to await the judgment in the High Court proceedings can be summarised thus:
(a) Resolution of the in-principle question of whether the applicant can be held liable in respect of the Incident has extremely significant consequences for the applicant. Justice demands that the liability issues are addressed through a particularly thorough litigation process, where all the relevant evidence can be properly identified, ventilated, and thoroughly assessed. The High Court is better placed to adjudicate on the issue of liability, given that its rules and practices are far more conducive to achieving the thoroughness of approach that is warranted in this case.
(b) The High Court, which is the superior court, was seized by the liability issue before the appeal in the Tribunal commenced and indeed before the Notice was issued.
(c) There is a very considerable overlap between the two sets of proceedings and a determination of the liability issue by the High Court would be very likely to dispose of the liability issue as it arises in the appeal. Even if that very likely outcome did not eventuate, the High Court’s judgment would likely narrow very substantially the live liability issues in the Appeal, thus saving costs for the parties and conserving judicial resources.
(d) If a stay is refused, that would inevitably create the risk of conflicting determinations by the High Court and the Tribunal on the same points. This is contrary to the applicant’s interests, and the wider public interest. The question of how the data security obligations provided for under the GDPR are to be construed and applied by the courts in a cyber-attack case is an important question which, to date, has not been subject to any reasoned judicial analysis, whether by the Courts or by the Tribunal. It would be wholly unsatisfactory, therefore, for conflicting judgments to emerge in the applicant’s case.
(e) Injustice and unfairness would result if the applicant were required to conduct two sets of heavy and substantially overlapping proceedings in tandem. This would be very costly, oppressively burdensome and extremely difficult for the applicant to manage. This may also prove seriously disruptive to one or both litigation processes.
(f) A stay would also ensure that public resources - specifically those of the Tribunal and/or the High Court, and the resources of the respondent - are not wasted on duplicative proceedings.
22. In outline, the respondent’s position is that the following compelling reasons support the contention that a stay should not be granted:
(a) The grant of a stay should be the exception, rather than the norm: the applicant has not demonstrated that the circumstances are exceptional so as to justify a stay, put forward “solid grounds” in support of the stay, or shown that the circumstances are “rare and compelling”.
(b) There would be a delay of at least 3 years or more from now before the Appeal was heard.
(c) The respondent is not a party to the High Court proceedings, and so those proceedings would not give rise to any issue estoppel in the appeal before the Tribunal. The High Court judgment would bind the Tribunal in relation to matters of law, but not as to issues of fact.
(d) The High Court proceedings will not provide material assistance to the Tribunal. First, the application provides little detail as the issue of law that is said to arise relating to the correct approach to GDPR Article 5(1)(f). Second, the way in which the case as to breach is framed in the appeal and in the High Court proceedings is not identical. The appeal is focused on the way in which the respondent has formulated the allegations of breach in the Notice, while the High Court proceedings are focused on the way in which those issues have been framed in the pleadings. Third, there are a number of matters raised in the grounds to the Tribunal that will not be addressed by a judgment of the High Court.
(e) Should either the Main Action or the Part 20 Action be settled, the stay will not achieve its asserted benefit, namely, to resolve issues before the that the High Court proceedings will go to trial but be disposed of in a judgment that will not address the full scope of the issues pleaded that are material to the Tribunal on this Appeal. There must be a real prospect of settlement of some part or all of the High Court proceedings. There is also a realistic possibility appeal.
(f) There is a strong likelihood that the grounds of appeal to the Tribunal will be materially amended following the High Court decision, which will leave the respondent not knowing the full extent of the applicant’s case for another two years.
(g) The anticipated delay in the hearing of this Appeal (i.e. to early 2024) would materially prejudice the respondent’s ability to address the relevant matters in evidence, and hence the Tribunal’s ability fairly to determine those matters.
(h) The First-tier Tribunal (and the Upper Tribunal) have been designated by statute as the specialist tribunals for data protection regulation. The Stay Application, asserts (without explanation) that it is preferable for the High Court to decide the issues of law relevant to this Appeal. Were the Stay Application (and comparable future applications in similar circumstances) to be granted, legal principles relevant to data breach cases would be developed by the High Court and the role of the specialist tribunals would be significantly constrained. Such an approach would undermine Parliament’s intention when establishing specialist tribunals to hear appeals of this nature.
Discussion
23. The determination of the instant stay application requires an exercise of balancing the ingredients enshrined in the overriding objective: managing the interface and overlap between two judicial organisations, the avoidance of excessive cost, the right of every litigant to expeditious justice, the minimising of litigation delays, the allocation of limited judicial resources and, broadly, the convenience of all concerned. The striking of the balance is delicate and intensely fact sensitive. As indicated above, I am satisfied that the dual considerations of ‘material assistance’ and ‘expediency’ traverse the same territory as applying rule 5(3)(j) of the 2009 Rules though the prism of rule 2 thereof. However, out of deference to the way in which the case has been put, and responded to, by the parties I will follow the well-trodden path of the First-tier Tribunal (Tax Chamber) in adopting the ‘material assistance’ and ‘expediency’ considerations. I confirm, however, that the same conclusion is reached on a proper application of rules 5(3)(j) and rule 2 of the 2009 Rules.
24. A number of the aforementioned ingredients combine to lead to the expectation that delay will be ordered by the Tribunal only if good reason is shown. The granting of a stay is the exception not the norm. That is not to put in place a legal threshold of exceptionally, but rather it is the expression of an expectation that a proper and robust application of the relevant principles is likely to lead to the granting of a stay in only a small minority of cases, identifiable on a case by case basis.
25. In this matter, having carefully considered the competing submissions, I accept that it is likely, although by no means inevitable, that the Tribunal will be materially assisted by a substantive judgment in the High Court proceedings.
26. Mr Pitt-Payne accepted there to be a “material overlap” in the two sets of proceedings, albeit to a limited extent, when in oral submissions he travelled through issues 7, 8, 9 and 17 in the High Court proceedings, though also observing that the issues were raised in significantly more detail in the Notice.
27. Having observed the extent of the overlap between the proceedings, Mr Pitt-Payne submitted that it was not safe to assume that all of the specific points relied upon by the respondent in the Notice would be raised by the parties in the High Court proceedings. I accept that this is so. I also accept, as Mr Pitt-Payne observed, that there is no identity of parties as between the two sets of proceedings and that the focus of the two sets of proceedings is different because there is a different litigation context and different drivers of the litigation issues. Nevertheless, on my analysis of the issues, there is a substantial overlap in the fundamental factual and legal building blocks required to reach a resolution in each of the proceedings. The issues in both sets of proceedings are rooted in the fundamental question of whether there has been a breach of Article 5(1)(f) GDPR, and the High Court’s conclusions and reasons in relation to such question are in my view likely to be of material assistance to the Tribunal.
28. Mr Pitt-Payne is, of course, correct in his assertion that any findings of fact made by the High Court will not, for the reasons he gives, be binding on the Tribunal. However, on the information currently before me, I accept the applicant’s submission that it is likely that such findings, although not binding, will materially assist the Tribunal in its fact finding exercise.
29. To my mind, it is highly relevant that Inbenta are a party to the High Court proceedings and that, as a consequence, the High Court will receive direct evidence from Inbenta in relation to the Incident. The applicant’s evidence to the High Court will no doubt also be tested by Inbenta. Inbenta play a central role in the Incident and it is likely that its evidence will be of some, if not great, value in ensuring that the underlying factual matrix is justly established. In contrast, Inbenta is not currently a party to the Tribunal proceedings, and neither party has suggested that an application is likely to be made which changes this position.
30. I further accept Ms Proops’ contention that there is a reasonable prospect of Tribunal being materially assisted by conclusions of the High Court on common issues of law; indeed, as the parties accept, the Tribunal would be bound by the High Court’s conclusions on matters of law where there is no higher authority on the point. I further accept Ms Proops’ submission that, at least as matters are currently formulated, an issue of law upon which there is as yet no legal authority is likely to loom large in both sets of proceedings i.e. the proper approach to the application of Article 5(1)(f) GDPR in a cyber security case and, in particular, in circumstances where the data controller did not process the personal data that was compromised. In weighing this feature into my overarching considerations, I have taken account of the fact that the question as to whether the applicant processed the data is a matter of disputed fact.
31. In considering the weight to be attached to the dual features of the likely factual and legal assistance to be gained by the Tribunal from the High Court judgment, I have taken full account of the difference in emphasis of the two sets of proceedings, that the High Court proceedings will not consider or determine all of the matters by reference to which the respondent reached her findings as to breach, and that there are issues raised in the grounds of appeal which are unlikely to be directly addressed in the High Court proceedings. As already indicated, however, I find that it is likely that the Tribunal will be materially assisted by the judgment of the High Court.
32. Moving on, having first observed that the Tribunal is a specialist Tribunal, Mr Pitt-Payne asserted that it was Parliament’s intention that the Tribunal resolve issues of law and fact in the field of data protection regulation. The instant application, he submits, “…raises issues of wide ranging importance about the respective roles of the Tribunal and the High Court…were stays to be regularly granted in cases of this nature it would undermine Parliament’s intention when establishing specialist tribunals to hear appeals of this nature.” It is asserted that this is “perhaps the most significant point” in the consideration of whether a stay should be granted [skeleton argument at paragraph 44].
33. The role of Tribunals as specialists in particular legal regimes is now well established, as is the proposition that weight ought to be accorded to Tribunal decisions because they are authored by specialist judges. It is also beyond doubt that expediency requires that the Tribunal’s expertise “should be used to best effect, to shape and direct the development of the law and practice” in its specialist field - R (Jones) v First-tier Tribunal (Social Entitlement Chamber) [2013] 2 AC 48 at [46]. Nevertheless, these are broad and general propositions that must be properly placed within the context of the fact sensitive and more nuanced exercise that I am required to undertake. In coming to my conclusions, I have taken account of the Tribunal’s specialist knowledge and experience, and its role in the sphere of data protection regulation, but I also observe that data protection regulation is not a sphere of judicial work which is solely occupied by the Tribunal, as is evidenced by the High Court proceedings referred to herein.
34. I have further taken account of the fact that resolution of the High Court proceedings may not ultimately be by way of a substantive judgment, the consequence of which is that if a stay were to be granted now, there is a risk that the proceedings in the Tribunal would have been delayed for no good reason. There is, though, no indication in the papers that such a possibility is anything other than speculative at the present time.
35. It is also a relevant feature that the respondent is not a party to the High Court proceedings, so the High Court will be denied the opportunity of having both the legal and the factual issues tested by the expert regulatory body. It may be that, as a consequence, the respondent has much to say before the Tribunal about the legal and factual analysis and conclusions of the High Court, and she would be entitled to make submissions in this regard, but this does not, in my view, lead to the conclusion that the judgment of the High Court will not be of material assistance to the Tribunal.
36. Turning to other issues, that the parties chose to pigeon-hole within the consideration of expediency. At the forefront, is the issue of the delay which will be caused to the Tribunal proceedings if a stay is granted in the terms sought. The applicant estimates, and this is not in dispute, that it is likely that a trial date in the High Court proceedings will be set for around September 2022. It is very unlikely that in a matter of such complexity the judgment will be delivered ex tempore, and allowing for a month or so for the judgment to be written is not unreasonable. The applicant seeks a further 28 days after judgment before the stay is lifted. This takes us to around December 2022, i.e. around 21 months hence, before judgment in delivered in the High Court proceedings - a substantial delay in the Tribunal’s proceedings by any method of calculation. Mr Pitt-Payne refers also to the possibility of an onward appeal in such proceedings. I have borne this in mind, but note that the applicant seeks a stay only until 28 days after the date of the handing down of judgment in the High Court proceedings. The question of an onward appeal is purely speculative at this stage, as are terms of any grounds of appeal and whether such grounds might impinge on matters of relevance to this Tribunal. If such an event does eventuate the parties will no doubt have a full opportunity at the relevant time to make submissions to this Tribunal as to the proper progress of the instant proceedings.
37. On the basis of the likely timeline for the High Court proceedings, as set out above, one can realistically envisage a listing date for the appeal in the Tribunal to be around the late Summer/early Autumn of 2023 - approximately 2½ years from now, nearly three years after the lodging of the notice of appeal and over five years after the Incident which led to the issuing of the Penalty Notice.
38. Although this delay is lengthy and, therefore, prima facie a significant factor weighing against the grant of the stay, it too must be set in context and its consequences must be thoroughly examined. One relevant consideration is the length of time between the applicant referring the potential data breach to the respondent (23 June 2018) and the service of the Penalty Notice by the respondent (13 November 2020). Whilst I do not accept Ms Proops’ assertion that the respondent intentionally sought to delay matters prior to the issue of the Penalty Notice, it is relevant that over two years passed between the applicant’s self-referral and the Penalty Notice being issued.
39. As to particular prejudice to the respondent arising from the substantial delay if a stay were to be granted, in his skeleton argument Mr Pitt-Payne put the respondent’s case thus: the delay “would materially prejudice the Commissioner’s ability to address the relevant matters in evidence, and hence the Tribunal’s ability fairly to determine those matter.” At the hearing, Mr Pitt-Payne elucidated to some extent, observing that the respondent would not, and could not be expected to, prepare her evidence for another two years or more.
40. This though is not a case which is going to turn on, or indeed feature, evidence from the Information Commissioner’s Office which relies upon witness memory or recollection of events. There is, as Mr Pitt-Payne accepted, a paper trail of information and documentary evidence leading up to the respondent’s decision. The witness evidence from the respondent will, I have no doubt, be presented after a careful consideration and analysis of such documentation. I accept that the evidence will require contextualising and explaining before the Tribunal, but absent more specific detail, it is difficult to understand why the respondent would be in a substantially, or even materially, worse position to provide such evidence in three years’ time than if a stay were not granted and she had to present it to the Tribunal in six to nine months’ time. In my view, the respondent’s skeleton argument substantially overstates the prejudice that would be caused to her ability to properly put her case, by any delay arising from the granting of a stay.
41. Mr Pitt-Payne further advanced the argument that, as the respondent is assisted in exercising her enforcement functions by guidance given by the Tribunal (in doing so, equating the Tribunal’s role to “marking the Commissioner’s homework”) any substantial delay in the respondent receiving such guidance will “significantly reduce the benefits of that guidance”. I have trouble understanding this submission, because the benefits to the respondent will be the same whenever the guidance is given. I do accept, however, that receiving of such guidance will self-evidently be delayed if the Tribunal’s decision is delayed. I also accept that one consequence of this, if the Tribunal were to ultimately conclude that the respondent had acted erroneously in the instant case, might be that the respondent proceeds on the same erroneous basis in other cases prior to the instant ‘guidance’ being received. I have taken this into account in my considerations.
42. A further concern, raised by the respondent early in the proceedings, was that the applicant may not be in a position to comply with the Penalty Notice if it is unsuccessful in the High Court proceedings. This concern has now been alleviated by Barclays Bank PLC issuing an irrevocable Standby Letter of Credit in the sum of £1,250,000 to secure fulfilment of the applicant’s obligation to the respondent in respect of the sum payable under the Penalty Notice.
43. Drawing all of the ingredients together, and having carefully considered the totality of the submissions made and information provided to me, I conclude that it would be expedient to grant a stay.
44. In my view, whilst the length of the delay is likely to be substantial, and noting that the delay strikes against the principles of minimising litigation delays and that every litigant has a right to expeditious justice, the prejudice caused to the respondent by such a delay will be minimal. This is to be contrasted with the significant factual and/or legal assistance likely to be gained by the Tribunal in awaiting the decision in the High Court. In particular, it is of relevance that the High Court has, as a party before it, an integral player in the Incident, Inbenta. This party will not be playing a direct part in the Tribunal proceedings and I have no doubt that justice will be enhanced in the Tribunal by awaiting a judgment of the High Court that has considered Inbenta’s evidence and submissions. In addition, as alluded to above, there is also a novel legal issue which strides across both sets of proceedings, the High Court’s conclusion in relation to which will also materially assist the Tribunal.
45. For these reasons, I grant the applicant’s application for a stay of proceedings.
46. I re-iterate, as I have done on numerous occasions above, that this conclusion is reached on the particular facts of this matter as they currently prevail and as they have been presented to me. The factual matrix in this case may change, which may mean that it is no longer appropriate for the stay to remain in place. If that is so, an appropriate application can be made, and will need to be considered in light of the facts as they present themselves at that time. In addition, given the intensely fact specific nature of the enquiry that must be undertaken when an application for a stay of the proceedings is being considered, it is axiomatic that the conclusions reached in this matter cannot and should not have any bearing on the consideration of a stay application made in a different appeal on different facts.
Decision
The applicant’s application for a stay of proceedings is granted.
The instant proceedings are stayed until 28 days after the handing down of the judgment in the High Court proceedings, or other event finally disposing of such proceedings.
Directions
A. By no later than 1 June 2021, the applicant must file with the Tribunal and serve on the respondent a note detailing the progress of the High Court proceedings, which must, inter alia, identify any event in those proceedings which is arguably capable of being material to an assessment of whether the stay in the Tribunal proceedings should be maintained (hereinafter referred to as “a Note”).
B. Thereafter, the applicant must file a Note with the Tribunal and serve a copy of the Note on the respondent, no less frequently than the first day of every third month thereafter, until the handing down of the judgment in the High Court proceedings or those proceedings are finally disposed of.
C. The applicant must file with the Tribunal and serve on the respondent within seven days of the document being sealed by the High Court, any document purporting to dispose of any part of the High Court proceedings. This includes any accompanying document identifying the reasons for the purported disposal.
D. A case management hearing is to be listed in the Tribunal in the instant appeal to be heard no later than 28 days after the date on which there is a final disposal of the proceedings in the High Court, whether that be by way of handing down of a judgment or otherwise. For the instant purposes, the High Court proceedings are to be treated as finally disposed of irrespective of whether an application for permission to appeal has been lodged, or whether time for lodging such an application has expired.
E. Liberty to apply.
Signed:
M O’Connor
Upper Tribunal Judge O’Connor
BAILII: