“a. Articles 5(l)(f), 24(1) and 32 of the GDPR, in that [DDL] has failed to implement the appropriate organisational measures to ensure the appropriate security of the personal data it processes and has processed personal data in an insecure manner. It is also noted that Article 5(l)(e), which states that data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which they are processed, is likely to have been infringed; b. Articles 13 and/or 14 GDPR, in that [DDL] has failed to provide data subjects with the information required by those Articles.”
“The Commissioner understands that the data subjects are not aware of the Breach, but were they to become aware it could cause high levels of distress, although financial damage is unlikely. The infringements of Articles 13 and 14 may have caused distress in the form of confusion or uncertainty about [DDL’s] processing of sensitive personal data.”
“83 I am further satisfied that JPL allowed at least some of the data processed on behalf of DDL to be stored in unlocked crates, and at least some of these were stacked in an outside yard before the documents were recovered, as a result of which some of the documents became wet. I find in addition that the yard was not an appropriately secure area in which to store personal data, due to the fact that the yard could be accessed by the occupants of and visitors to three residential flats, via fire escapes that as a matter of common sense must be readily accessible. The unlocked crates in the yard could also potentially be accessed by business visitors to the Property. I conclude from this that JPL’s methods of data storage was not appropriately secure and did not afford sufficient protection against accidental loss or destruction, and that this was a breach of the integrity and confidentiality requirements of Article 5(1)(f) for which DDL retained responsibility by virtue of Article 5(2). 84 I find in addition, on the balance of probabilities, that at the date of the search warrant JPL was storing personal data in a form that permitted identification of data subjects for longer than necessary. This is because the presence of personal data that was two or more years old indicates that not all data was destroyed when it was no longer required. DDL has confirmed that historic, hard copy documents were not required for record keeping purposes. Given the findings I have already made in relation to the provenance of these documents, and the absence of any evidence that the historic records had only been passed to JPL for destruction recently, I am satisfied that the retention of this data by JPL was a breach of the storage limitation requirements of Article 5(1)(e,) for which DDL also retained responsibility by virtue of Article 5(2). I note in addition that, other than Mr Budhdeo’s witness testimony, no contemporaneous evidence has been adduced to show when and how JPL securely destroyed personal data on DDL’s behalf. 85 I find that DDL’s failure to devise adequate data processing policies contributed to JPL’s breaches of relevant data processing requirements. In particular, I find that the absence of a retention policy and of a clear explanation by DDL of the processes JPL must follow when destroying personal data incidental to the destruction of medicinal waste must have contributed to JPL’s breaches as it was provided with no appropriate procedures to follow. 86 I conclude as a consequence that DDL’s responsibility for JPL’s breaches also amount to a breach of the requirements of Article 24(1), in that DL failed to implement appropriate and organisational measure to ensure that JPL’s processing was performed in accordance with the GDPR, as well as a breach of the requirements of Article 32, in that DDL failed to implement appropriate measure to ensure a level of security appropriate to the risks.”
“88 In accordance with the principles identified in Hope and Glory [i.e. R (Hope and Glory) v City of Westminster Magistrates’ Court[2011] EWCA Civ 31 ,[2011] 3 All ER 57 ] I have afforded appropriate weight to the Commissioner’s decision to issue an MPN [i.e. a penalty notice] but note that the level of penalty was predicated upon 500,000 documents having been seized. I have instead considered the appropriate level of penalty based on a finding that 66,638 documents containing personal data were recovered, 53,871 of which contained special category data. 89 I nevertheless reach the same conclusion as the Commissioner, in that the contraventions identified are sufficiently serious to justify issuing a penalty. However, in contrast to the approach taken by the Commissioner in the [Notice], I do not consider a breach of Article 24(1) to be a contravention in relation to which an MPN may be imposed under s. 155(1), because it is not a breach of GDPR listed in s. 149(2). 90 I adopt the Commissioner’s assessment of the factors set out in Article 83(2), other than her assessment of the number of data subjects affected by the contraventions which was based on the MHRA’s estimated figure of 500,000 documents. I note in particular the Commissioner’s conclusions as to the gravity of the breach and the risk of significant emotional distress being caused to a vulnerable group of data subjects were they to become aware of the contraventions. I also agree with the Commissioner’s conclusion that the serious breaches of the data processing principles occasioned by JPL’s activities were largely due to DDL’s negligence in relation to its Article 24(1) and Article 32 obligations. 91 I conclude as a consequence that issuing an MPN is an effective, proportionate and dissuasive response to DDL’s contraventions. 92 I note the statutory intention of both the GDPR and DPA is that a higher financial penalty should be imposed under this than other the predecessor legislation. Having considered the Commissioner’s statutory guidance and the circumstances of this case, I am satisfied that the Commissioner’s penalty assessment in the NOI [i.e. the notice of intent which the Commissioner issued in accordance with paragraph 2 of schedule 16 to the DPA] of£400,000 was appropriate given the facts as she understood them to be. I am further satisfied that her subsequent decision to reduce the penalty to£275,000 was appropriate in light of DDL’s financial position. 93 I agree that a person responsible for a serious contravention of the GDPR should not avoid a monetary penalty solely on the basis their financial position, since such a practice would undermine a key purpose of the legislation. However, financial hardship remains an important consideration in terms mitigation. I find that it has already been reflected in an appropriate manner in the MPN under appeal. 94 I am satisfied that the amount of the penalty imposed on DDL should be reduced further in light of the Tribunal’s conclusion that substantially fewer than 500,000 documents were recovered. However, 12,491 documents containing personal data and 53,871 documents containing special category data are still very large numbers of documents, and the significant aggravating factor that majority contained the personal data of highly vulnerable data subjects remains. 95 Given the gravity of the contraventions, my additional finding that DDL is responsible for a breach of Article 5(1)(e) obligations, and the long list of aggravating criteria identified in the MPN, I am satisfied that the level of the penalty imposed should not be reduced by a percentage based on solely on the lower numbers of documents. 96 Having taken all of these matters into consideration I have decided that the amount of the [Notice] should be reduced to£92,000 , which is a reduction of approximately two thirds.”
“1. Personal data shall be: … (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed … (‘storage limitation’); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’). 2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”
“Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.”
“The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following— (a) a provision of Chapter II of the GDPR [now ‘UK GDPR’] or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing); (b) a provision of Articles 12 to 22 of the GDPR [now ‘UK GDPR’] or Part 3 or 4 of this Act conferring rights on a data subject; (c) a provision of Articles 25 to 39 of the GDPR [now ‘UK GDPR’] or section 64 or 65 of this Act (obligations of controllers and processors) ….”
“1. Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive. 2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following: (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.” (a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them; (b) the intentional or negligent character of the infringement; (c) any action taken by the controller or processor to mitigate the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32; (e) any relevant previous infringements by the controller or processor; (f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement; (g) the categories of personal data affected by the infringement; (h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement; (i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures; (j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.”
“Step 1. An ‘initial element’ removing any financial gain from the breach. Step 2. Adding in an element to censure the breach based on its scale and severity, taking into account the considerations identified at section 155(2)-(4) of the DPA. Step 3. Adding in an element to reflect any aggravating factors. Step 4. Adding in an amount for deterrent effect to others. Step 5. Reducing the amount (save that in the initial element) to reflect any mitigating factors, including ability to pay (financial hardship).” “Generally”, it was said, “the amount will be higher where … vulnerable individuals or critical national infrastructure are affected”
“I conclude … that to a limited extent the burden of proof is of secondary importance in the context of a full merits review. However, when the appeal is against a penalty imposed in response to perceived infringements, I am satisfied that there must also be an initial evidential burden imposed upon the decision maker who is required to prove that the infringement has taken place. As a matter of common sense, this evidential burden must shift to the other party once evidence of the infringements has been introduced.”
“(i) it is the appellant who knows, or ought to know, the true facts; (ii) s 60(7) makes express provision placing the burden on Customs in relation to specified matters. This suggests that the draftsman saw it as an exception to the ordinary rule, and seems inconsistent with an implied burden on Customs in respect of other matters; … (vi) to reverse the burden of proof would make the penalty regime unworkable in many cases. In a case such as the present, a ‘best of judgment’ assessment is needed precisely because the potential taxpayer has failed to keep proper records, so that positive proof in the sense required in the ordinary civil courts is not possible. The assessment may be no more than an exercise in informed guesswork. Indeed to put the burden on Customs would tend to favour those who have kept no records at all, as against those who have kept records, which are merely inadequate, but may be enough to give rise to an inference on the balance of probabilities.”
“It means no more than this, that during the trial of an issue of fact there will often arrive one or more occasions when, if the judge were to take stock of the evidence so far adduced, he would conclude that, if there were to be no more evidence, a particular party would win. It would follow that, if the other party wished to escape defeat, he would have to call sufficient evidence to turn the scale. The identity of the party to whom this applies may change and change again during the hearing and it is often convenient to speak of one party or the other as having the evidentiary burden at a given time. This is, however, no more than shorthand, which should not be allowed to disguise the fact that the burden of proof in the strict sense will remain on the same party throughout, which will almost always mean that the party who relies on a particular fact in support of his case must prove it. I do not see how this fact of forensic life bears on the present case.”
“It may well be that, if the taxpayer companies’ version does not correspond with the true facts, it must follow that someone was guilty of fraud. This does not mean that, by traversing the taxpayer companies’ case, the Revenue have taken on the burden of proving fraud. Naturally, if they produce no cogent evidence or argument to cast doubt on the taxpayer companies’ case, the taxpayer companies will have a greater prospect of success. But this has nothing to do with the burden of proof, which remains on the taxpayer companies because it is they who, on the law as it has stood for many years, are charged with the task of falsifying the assessment. The contention that, by traversing the taxpayer companies’ version, the Revenue are implicitly setting out to prove a loss by fraud overlooks the fact that, in order to make good their case, the Revenue need only produce a situation where the commissioners are left in doubt. In the world of fact there may be only two possibilities: innocence or fraud. In the world of proof there are three: proof of one or other possibility and a verdict of not proven. The latter will suffice, so far as the Revenue are concerned.”
“[48] It is normal for an appellant to have the responsibility of persuading the court that it should reverse the order under appeal, and the [Magistrates’ Courts Rules 1981 ] envisage that this is so in the case of statutory appeals to magistrates’ courts from decisions of local authorities. We see no indication that Parliament intended to create an exception in the case of appeals under [theLicensing Act 2003 ]. [49] We are also impressed by [counsel for the Council’s] point that in a case such as this, where the licensing sub-committee has exercised what amounts to a statutory discretion to attach conditions to the licence, it makes good sense that the licensee should have to persuade the magistrates’ court that the sub-committee should not have exercised its discretion in the way that it did rather than that the magistrates’ court should be required to exercise the discretion afresh on the hearing of the appeal.”
“Brady was a case about direct taxation, not VAT, but I can see no reason why the same principles should not apply to a ‘best of judgment’ assessment to VAT made under s 73 of VATA 1994. The guidance given by Carnwath LJ in the Khan case may have been technically obiter on this point, but he regarded the position on an appeal against such an assessment as ‘well-established’ and cited Brady with apparent approval. In my respectful view, he was clearly right to do so.”
“Given all the variables, the proper conclusion to the first question can only be stated in very general terms. It is right in all cases that the magistrates’ court should pay careful attention to the reasons given by the licensing authority for arriving at the decision under appeal, bearing in mind that Parliament has chosen to place responsibility for making such decisions on local authorities. The weight which magistrates should ultimately attach to those reasons must be a matter for their judgment in all the circumstances, taking into account the fullness and clarity of the reasons, the nature of the issues and the evidence given on the appeal.”
“The authority [be it, adjudicator, Immigration Appeal Tribunal or immigration judge] will wish to consider and weigh all that tells in favour of the refusal of leave which is challenged, with particular reference to justification under article 8(2). There will, in almost any case, be certain general considerations to bear in mind: the general administrative desirability of applying known rules if a system of immigration control is to be workable, predictable, consistent and fair as between one applicant and another; the damage to good administration and effective control if a system is perceived by applicants internationally to be unduly porous, unpredictable or perfunctory; the need to discourage non-nationals admitted to the country temporarily from believing that they can commit serious crimes and yet be allowed to remain; the need to discourage fraud, deception and deliberate breaches of the law; and so on. In some cases much more particular reasons will be relied on to justify refusal, as in Samaroo v Secretary of State for the Home Department [2002] INLR 55 where attention was paid to the Secretary of State’s judgment that deportation was a valuable deterrent to actual or prospective drug traffickers, or R (Farrakhan) v Secretary of State for the Home Department[2002] QB 1391 , an article 10 case, in which note was taken of the Home Secretary’s judgment that the applicant posed a threat to community relations between Muslims and Jews and a potential threat to public order for that reason. The giving of weight to factors such as these is not, in our opinion, aptly described as deference: it is performance of the ordinary judicial task of weighing up the competing considerations on each side and according appropriate weight to the judgment of a person with responsibility for a given subject matter and access to special sources of knowledge and advice. That is how any rational judicial decision-maker is likely to proceed. It is to be noted that both Samaroo and Farrakhan (cases on which the Secretary of State seeks to place especial reliance as examples of the court attaching very considerable weight to decisions of his taken in an immigration context) were not merely challenges by way of judicial review rather than appeals but cases where Parliament had specifically excluded any right of appeal.”
“It is thus apparent that ‘the proper consideration and weight’, which the Secretary of State says should be given to any previous decision of the authority, will depend upon the nature of the previous decision in question and its relevance to the issue before the tribunal. The decision of the competent authority under the NRM process was an essentially factual decision and, for the reasons given, both the FTT and the UT were better placed to decide whether MS was the victim of trafficking than was the authority.”