Central London Community Healthcare NHS Trust v The Information Commissioner [2013] UKUT 551 (AAC)

UKUT-AAC
Central London Community Healthcare NHS Trust v The Information Commissioner
[2013] UKUT 551 (AAC) · 2013-11-08
[1]The Information Commissioner (“the Commissioner”) has the (relatively new) power to issue a monetary penalty notice (an “MPN”) on data controllers, imposing what is, in effect, a civil fine of up to £500,000 for certain breaches of the data protection legislation. The Commissioner imposed a penalty of £90,000 on the Central London Community Healthcare NHS Trust (“the Trust”) for its admitted data protection breaches. The First-tier Tribunal dismissed the Trust’s appeal. The Trust now appeals to the Upper Tribunal against both the imposition of the MPN and the amount of that penalty.[2]To date the First-tier Tribunal (“the tribunal”) has heard three such appeals against MPNs (the appeal in this case, under reference EA/2012/0111, along with Scottish Borders Council v Information Commissioner (EA/2012/0212) and Niebel v Information Commissioner (EA/2012/0260)). However, this is the first case to be determined at Upper Tribunal level.[3]The Trust has four grounds of appeal. The first, the “discretion” ground, is that the tribunal erred in law by not holding that the Commissioner had(a) failed to recognise that he had a discretion as to whether to serve an MPN; and(b) failed to consider how that discretion should be exercised. The second, the “assessment” ground, is that the tribunal should have concluded that the Commissioner was barred from serving an MPN as the process following the Trust’s self-report of its breach was a consensual process and so an “assessment” within the terms of the legislation. In effect, the argument is that the Trust can claim the benefit of a form of statutory immunity. These two grounds both relate to whether the Commissioner could or should have served an MPN at all.[4]The remaining two grounds of appeal concern the amount of the penalty under the MPN. The third ground of appeal, the “discount” ground, is that the way in which the Commissioner operates his early payment discount scheme constitutes a fetter on the right of appeal, and is therefore unlawful (and so the tribunal should have applied the 20 per cent discount to reduce the amount of the penalty). The fourth and final ground, the “quantum” ground, is that in any event the tribunal should have reduced the amount of the penalty, as the Commissioner’s approach was, so it is said, legally unsustainable.[5]I held an oral hearing of this appeal on 16 October 2013. I am indebted to Mr Timothy Pitt-Payne QC (counsel for the Trust) and Ms Anya Proops (counsel for the Commissioner) for their careful and clear submissions, both on paper and orally. I am dismissing this appeal for the reasons that follow. The facts of the case[6]The facts of the case are not in dispute. I can simply adopt the agreed statement of facts as set out in the tribunal’s decision (FTT decision at paragraph [4]):
‘4. The parties agree the following factual background relating to the data breach in issue in this case: a. The Trust is responsible for managing vast quantities of sensitive patient data; b. The Trust had in place an arrangement by which it faxed, each weekday evening, highly sensitive patient data relating to patients in its palliative care unit (“the Unit”) to St John's Hospice ("the Hospice"). The data in question was contained in inpatient lists, to assist doctors providing out of hours care for these individuals; c. The Trust used a fax protocol (or task sheet for the administrator) for sending the lists which had been agreed with the Hospice ("the protocol"). The protocol required the Unit to telephone the Hospice to check that the relevant fax had been received; d. The person responsible for faxing the lists to the Hospice ("the administrator") had not been given adequate training in respect of the faxing process and had not been specifically trained to obtain management approval to vary the fax protocol in accordance with changing operational needs; e. In March 2011, the administrator became aware that the list needed to be sent to an additional fax number at the Hospice (“the additional fax number”). The administrator did not update the protocol with the additional fax number and did not obtain approval from her manager in respect of the new arrangements; f. Thereafter the administrator (or her stand-in) faxed the inpatient lists on some 45 separate occasions to a fax number which was not in fact the number for, nor that which had been provided by, the Hospice; g. The administrator did telephone the Hospice to confirm that the first fax had been received but did not check that the second fax had been received under the additional fax number; h. The error only came to light when, on 6 June 2011, a member of the public rang the administrator to inform her that he had been receiving the inpatient lists since 28 March 2011 but had shredded them. The Trust has been unable to trace the member of the public following this call and, accordingly, has no way of confirming precisely what had happened to the data; i. The lists which were wrongly sent to the member of the public contained data relating to 59 individuals, all of whom were regarded as 'vulnerable adults' due to their age and ill health. The data in issue included not only the patients' names but their medical diagnoses; medical treatment; information about the patients' domestic situations (including third party/family information) and resuscitation instructions. This information amounted to acutely private information and sensitive personal data (under section 2 DPA).’
[7]I accept both of Mr Pitt-Payne’s points that the Trust itself reported the breach to the Commissioner and that thereafter the Trust fully co-operated with the Commissioner’s investigation. It remains, however, as I remarked at the oral hearing, a sorry tale. In that context I note the tribunal’s further findings (neither of which was in dispute) that(i) the Trust was required to report the breach under guidance issued by the Department of Health and the NHS (FTT paragraphs [70]-[71]); and(ii) by the time the Trust took action to notify the affected individuals (or “data subjects”), only 15 could be so advised as the other 44 persons had died in the meantime (FTT paragraph [40(i)]). The legislative framework[8]The Trust is a “data controller” within the meaning of section 1(1) of the Data Protection Act 1998 (“the DPA”). The patients in question are or were “data subjects”, also within section 1(1); the information in question was obviously “sensitive personal data” within section 2(e). Furthermore, subject to any exemptions (which do not apply here) “ it shall be the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller” (section 4(4)).[9]Part I of Schedule 1 to the DPA sets out the eight data protection principles, the seventh of which is that “ Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data .” Paragraphs 9-12 of Part II of the Schedule make further provision in this regard, including the requirements that:
‘9. Having regard to the state of technological development and the cost of implementing any measures, the measures must ensure a level of security appropriate to– (a) the harm that might result from such unauthorised or unlawful processing or accidental loss, destruction or damage as are mentioned in the seventh principle, and (b) the nature of the data to be protected. 10 . The data controller must take reasonable steps to ensure the reliability of any employees of his who have access to the personal data.’
[10]From the outset the DPA vested the Commissioner with a wide range of enforcement powers (see Part V, sections 40-50). As originally enacted, the DPA included no provision for MPNs (and, indeed, no such provision was required under the EU Data Protection Directive, also known as Directive 95/46/EC, which the DPA implements; however, the position may change in the light of current developments at the European level). But section 55A of the DPA – which appears in Part VI of the DPA under the beguiling heading of “Miscellaneous and General” provisions – now provides as follows:
‘55A Power of Commissioner to impose monetary penalty (1) The Commissioner may serve a data controller with a monetary penalty notice if the Commissioner is satisfied that— (a) there has been a serious contravention of section 4(4) by the data controller, (b) the contravention was of a kind likely to cause substantial damage or substantial distress, and (c) subsection (2) or (3) applies. (2) This subsection applies if the contravention was deliberate. (3) This subsection applies if the data controller— (a) knew or ought to have known— (i) that there was a risk that the contravention would occur, and (ii) that such a contravention would be of a kind likely to cause substantial damage or substantial distress, but (b) failed to take reasonable steps to prevent the contravention. (3A) The Commissioner may not be satisfied as mentioned in subsection (1) by virtue of any matter which comes to the Commissioner's attention as a result of anything done in pursuance of— (a) an assessment notice; (b) an assessment under section 51(7). (4) A monetary penalty notice is a notice requiring the data controller to pay to the Commissioner a monetary penalty of an amount determined by the Commissioner and specified in the notice. (5) The amount determined by the Commissioner must not exceed the prescribed amount. (6) The monetary penalty must be paid to the Commissioner within the period specified in the notice. (7) The notice must contain such information as may be prescribed. (8) Any sum received by the Commissioner by virtue of this section must be paid into the Consolidated Fund. (9) In this section— “data controller” does not include the Crown Estate Commissioners or a person who is a data controller by virtue of section 63(3); “prescribed” means prescribed by regulations made by the Secretary of State.’
[11]Section 55A was inserted into the DPA (along with the supplemental sections 55B-55E) by section 144(1) of the Criminal Justice and Immigration Act 2008. Section 144 was included in the 2008 Act at a relatively late stage in the Bill’s progress through Parliament and represented the legislature’s response to some high profile losses of personal data (most notably, and most notoriously, HMRC’s loss of the child benefit database on two data disks: see FTT paragraph [69]). The new power under section 55A to issue an MPN came into force on 6 April 2010. Section 55A(3A) was enacted by section 175 of, and paragraph 13 of Part 5 of Schedule 20 to, the Coroners and Justice Act 2009 and came into effect on the same date. Sub-section (3A) cross-refers to section 51(7) of the DPA, which provides as follows:
‘(7) The Commissioner may, with the consent of the data controller, assess any processing of personal data for the following of good practice and shall inform the data controller of the results of the assessment.’
[12]Section 51 as a whole is concerned with the “General duties of Commissioner”. It provides no definition of “assess” or “assessment”. However, for the purposes of that section, including therefore sub-section (7), section 51(9) provides that:
‘“good practice” means such practice in the processing of personal data as appears to the Commissioner to be desirable having regard to the interests of data subjects and others, and includes (but is not limited to) compliance with the requirements of this Act.’
[13]Finally, the maximum penalty, or “prescribed amount” for the purposes of section 55A(5), is £500,000 (Data Protection (Monetary Penalties) (Maximum Penalty and Notices) Regulations 2010 (SI 2010/31), regulation 2). I turn now to the Trust’s four grounds of appeal. I deal with the first two grounds in reverse order as, if the second ground of appeal succeeds, then the MPN must be quashed as having no valid statutory basis. Ground 2: the assessment ground The tribunal’s approach to the case put by the Trust[14]This ground of appeal turns on a question of pure statutory interpretation. Mr Pitt-Payne’s main contention before the tribunal was that the Commissioner’s investigation, following the Trust’s self-reporting of its breach, was a consensual “assessment” (FTT paragraph [62(a)]). As such, he submitted, the Commissioner was barred from relying on that process for the purpose of imposing an MPN. The tribunal, having examined counsel’s competing submissions, dismissed this argument (FTT paragraph [91]):
‘91. We therefore find that a voluntary notification of a serious breach of the DPPs [data protection principles] does not preclude the IC [the Commissioner] from investigating the breach with a view to issuing an MPN as well as taking other enforcement action.’
The parties’ submissions before the Upper Tribunal[15]Mr Pitt-Payne developed his central submission that as the Trust voluntarily self-reported its breach to the Commissioner, and co-operated fully thereafter, the process that followed was accordingly an “assessment” within section 51(7) of the DPA. As such, the consequence of the “carve out” under section 55A(3A) was that the Commissioner could not rely on that process as the basis for imposing an MPN. This meant that the MPN was “not in accordance with the law” within the terms of section 49 of the DPA (see further the discussion below), and the tribunal had erred in law in not finding as much.[16]Mr Pitt-Payne’s analysis undeniably represents a head-on challenge to the Commissioner’s jurisdiction to impose MPNs in the circumstances that he set out. The tribunal therefore took care to rehearse his submissions in some detail (FTT paragraphs [64]-[75]). In those circumstances, as the tribunal’s decision is a publicly available document, I need not formally recite those same submissions here. Mr Pitt-Payne also made a number of further arguments which were not put to, or at least noted by, the tribunal below. These related to the natural meaning of the statutory language (“assessment” not being a term of art), the permeable boundary between the Commissioner’s educative and enforcement functions and the relevance of the definition of “good practice” in section 51(9).[17]Ms Proops’s submissions before the tribunal below were likewise referred to extensively in the tribunal’s decision (FTT paragraphs [76]-[84]) and I hope I also do her no disservice by not repeating them in similar detail here. In short, her core argument was that this ground of appeal rested on a fundamentally distorted analysis of the nature of the Commissioner’s functions when investigating a self-reported breach and could not be reconciled with a robustly purposive (as opposed to a narrowly linguistic) reading of the relevant provisions of the DPA. In any event, if Parliament’s intention had been to exclude self-reported breaches from the section 55A regime, then such a limitation could have been expressly spelt out in the legislation. The Upper Tribunal’s analysis[18]I have referred above (at paragraph 14) to the tribunal’s conclusion on this ground of appeal (at FTT paragraph [91]). However, I must acknowledge that this was preceded by a careful analysis of the parties’ respective submissions (at FTT paragraphs [85]-[90]). The tribunal’s reasoning may be summarised in this way. First, the tribunal concluded that section 51(7) of the DPA was designed to enable the Commissioner to conduct good practice audits as a means of educating data controllers. Second, the underlying purpose of the “carve out” in section 55A(3A) was to incentivise data controllers to agree to such good practice audits (bearing in mind the limited scope for compulsory audits under section 41A), rather than to encourage data controllers to self-report specific serious contraventions. Third, it followed that section 51(7) (and thus the section 55A(3A) carve out) was not intended to capture cases where the Commissioner investigated a self-reported serious breach, as those types of cases necessarily involved consideration of the full range of statutory sanctions available, including the option of an MPN. Any other interpretation (e.g. one that prioritised a narrow linguistic analysis of what constituted an “assessment” within section 51(7)) would deprive section 55A of much of its practical effect.[19]A good test of any working hypothesis is how it reacts when pushed to the extremes of the model. It was in this regard, and with respect, that I found Mr Pitt-Payne’s analysis, so forceful on first impression, as wanting. I was particularly influenced by the following factors.[20]First, the fact is that a serious contravention of the data protection principles may come to the Commissioner’s attention in any one of four ways. First, it may simply come into the general public domain e.g. by way of conventional media coverage or dissemination via social media. Second, an individual data subject may make a specific complaint to the Commissioner. Third, the relevant data controller may (as here) voluntarily self-report the breach in question. Fourth, and finally, the contravention may come to light where the Commissioner already has in train a compulsory assessment (under section 41A) or a consensual good practice audit (GPA) or assessment (under section 51(7)).[21]On the tribunal’s analysis, which I adopt, the carve out in section 55A(3A) only bars the Commissioner from serving an MPN in the fourth and last of these scenarios. In the other cases it is pure happenstance as to how the matter comes to light. As it transpired here, the unidentified member of the public who received the multitudinous faxes in this case eventually contacted the Trust, which then in turn reported the contravention to the Commissioner. However, that person might equally well have gone direct to the Commissioner (or indeed to the police or a national newspaper or their Twitter account); in all those circumstances the Commissioner would undoubtedly have the power to issue an MPN. Chance in the way that news of the contravention reaches the Commissioner should not determine his powers to issue an MPN, save in the specific case of the statutory carve out, as construed in the light of the regulatory purpose.[22]Second, the logical implication of Mr Pitt-Payne’s construction of the legislative scheme is that a data controller responsible for a deliberate and very serious breach of the DPA would be able to avoid an MPN by simply self-reporting that contravention and co-operating with the Commissioner thereafter. Such an offender would be in a better position than a data controller acting in good faith, but unaware of a breach, who could be the subject of an MPN because e.g. a third party had reported the matter to the Commissioner. Such an arbitrary outcome would necessarily undermine both the effectiveness of, and public confidence in, the regulatory regime.[23]Mr Pitt-Payne countered that the MPN option would remain available where a data controller had self-reported the breach but had then failed to co-operate with the Commissioner’s investigation. However, as Ms Proops points out, this fails to explain how the Commissioner could subsequently rely on information obtained during the earlier “consensual” phase of the investigation, assuming that Mr Pitt-Payne’s analysis of the scope of section 51(7) (and thus section 55A(3A)) was right. Mr Pitt-Payne further submitted that where a data controller self-reported a particularly egregious breach, the Commissioner could reserve his position as regards the MPN option by serving an information notice under section 43 of the DPA, so taking the matter outside the statutory carve out. However, as Ms Proops again observed, this argument is self-defeating. There is no real incentive to self-report if the serious defaulter knows that self-notification is not a “get out of jail free card” because the Commissioner can at any time trump that by issuing a section 43 information notice. Moreover, it could not sensibly be Parliament’s intention that, in order to preserve his power to issue an MPN, the Commissioner should have to go through the further hurdle of the section 43 procedure, when many data controllers will co-operate in any event.[24]I therefore find both the tribunal’s analysis and its conclusion compelling and have no hesitation in ruling that there is no error of law in its approach. I adopt the tribunal’s reasoning accordingly. The “assessment” ground of appeal fails. The Commissioner has the power under statute to issue an MPN in the wake of a self-reported breach by the data controller whether that is followed by no, partial or full co-operation in the subsequent investigation. Ground 1: the discretion ground The Commissioner’s investigation and the exercise of the discretion[25]The “discretion” ground of appeal can only be understood in the context of the Commissioner’s investigation. This was covered in some detail by the tribunal in its decision (FTT paragraphs [40]-[57]). The salient events were as follows.[26]On 22 July 2011 the Trust notified the Commissioner by telephone of the contravention that had occurred. As the Commissioner’s investigation unfolded, this self-report was followed by further telephone conversations and correspondence between officials of the Trust and the Commissioner (and in particular the Commissioner’s enforcement case officer, a Mr Powell: FTT paragraphs [40]-[47]).[27]In an undated 10-page document, entitled a Regulatory Action Case Summary, but which was clearly prepared on or after 3 October 2011, Mr Powell summarised the results of the Commissioner’s investigation to date and recommended that “regulatory action be considered and whether the circumstances of this incident are substantial enough to warrant a CMP [civil monetary penalty]” (FTT paragraph [48]).[28]On 5 January 2012 the Commissioner’s enforcement working party met (FTT paragraph [51]). This group included Mr Powell and other officials but neither the Commissioner nor Deputy Commissioner. The working party considered a further revised recommendation report from Mr Powell, in which he had ticked three options as potentially appropriate (civil monetary penalty notice, enforcement notice and undertaking) and in effect ruled out four others (information notice, consensual audit, compulsory audit and negotiation/informal resolution). Having reviewed the history of the matter, his reasons included the observation that: ‘the circumstances of this incident, plus detriment caused to the individuals concerned appear substantial enough to consider a CMP. Consideration could also be made to the use of an undertaking or Enforcement Notice in terms of assisting CLCH achieve future DPA compliance’ (Regulatory Action Recommendation Report, pp. 13 &14).[29]The minute of the first enforcement working party meeting concluded that: ‘The outcome of the first working party meeting was that this case does represent a serious breach of the DPA, that disclosure of the data was of a kind likely to have caused substantial distress, and that CLCH knew or ought to have known that an information security risk was present. Therefore this breach will be referred to the Deputy Commissioner as a recommended CMP’ (Regulatory Action Recommendation Report, p.16).[30]On 17 January 2012 a second working party of officials met to consider the appropriate amount of the penalty (FTT paragraphs [52]-[53]). Having considered what it itemised as the aggravating and mitigating factors and the underlying objectives, the group recommended to the Deputy Commissioner that an MPN for the sum of £90,000 be issued to the Trust (Regulatory Action Recommendation Report, p.18).[31]On 8 February 2012 the Commissioner issued the Trust with a formal Notice of Intent (FTT paragraph [54]), a necessary statutory precondition before imposing an MPN (see section 55B(1)-(4)). This document set out the statutory framework, the grounds on which the Commissioner proposed to serve an MPN and the aggravating and mitigating features of the case, with the conclusion that the Commissioner was minded to impose an MPN in the sum of £90,000 as being “appropriate”.[32]On 8 March 2012 the Trust responded by letter to the Notice of Intent (NoI). The tribunal’s findings on this letter merit quoting in full (FTT paragraph [55]):
‘55. The Chief Executive of the Trust provided representations in response to the NoI on 8 March 2012 ("the March representations"). In the March representations, the Trust conceded that the breach was of an order that it engaged the IC’s powers under section 55A. It also explicitly accepted that a financial penalty was warranted. However, it drew the IC’s attention to what were largely the mitigating features and invited the IC to consider a lower penalty figure. The Chief Executive expressed the Trust’s position as follows: Given the severity of the breach in such a sensitive service and the fact that we should have done more to secure a better understanding of our operative to seek management approval for a variation, we will not appeal the Commissioner’s assignment of a financial penalty. However, we would request that, if these representations are accepted, he gives consideration to significantly reducing the penalty from the level of £90,000 indicated. ’
[33]On 24 April 2012 a further meeting of the Commissioner’s officers (including on this occasion the Deputy Commissioner) met to consider the Trust’s representations. The (very) brief minute of that meeting recorded that the representations were considered but that the panel concluded that no change was needed in either the decision to impose an MPN or the amount of the penalty (Regulatory Action Recommendation Report, p.18; FTT paragraph [56]).[34]On 27 April 2012 the Commissioner issued the MPN under section 55A of the DPA in largely the same terms as the Notice of Intent (FTT paragraphs [58]-[60]), albeit with some minor drafting amendments. The tribunal’s approach to the case put by the Trust[35]Mr Pitt-Payne’s argument before the tribunal on this point was in essence two-fold – that the evidence did not explain the basis on which the Commissioner’s discretion had been exercised and that in any event the Commissioner had exercised his discretion wrongly (FTT paragraph [62(c)]). The tribunal considered this submission at some length (FTT paragraphs [105]-[124]). In summary, the tribunal concluded that the meeting of 24 April 2012 in effect recorded the Commissioner’s decision (FTT paragraph [121]). In the same passage the tribunal continued:
‘In exercising his discretion he seems to us to have had all the necessary information before him to take a decision including the various regulatory options available.’
The parties’ submissions before the Upper Tribunal[36]It was common ground between the parties that, as a matter of principle and statutory construction, the Commissioner has a discretion as to whether to issue an MPN. According to section 55A(1) (see paragraph 10 above), the Commissioner “ may serve a data controller with a monetary penalty notice if the Commissioner is satisfied” (emphasis added) that the conditions therein are met.[37]Mr Pitt-Payne sought to persuade me that the Commissioner had both failed to address his mind as to the existence of the statutory discretion under section 55A and failed to consider how that discretion should be exercised. He expressly (and, in my view, rightly) abjured any suggestion that the Commissioner himself was required personally to exercise that discretion. Thus he accepted that the Commissioner inevitably performed his statutory functions through his officers and staff. There was, however, in Mr Pitt-Payne’s submission, a fundamental evidential gap, indeed “an enormous hole in the Commissioner’s case”. The only witness evidence put forward on the Commissioner’s behalf was that of Mr Powell, who was not the actual decision-maker and added little of any significance. Mr Pitt-Payne then took me through the documentary paper trail, seeking to make good his submissions on this ground.[38]Mr Pitt-Payne observed that the Regulatory Action Case Summary merely recommended that others should consider the issue of an MPN. Admittedly Mr Powell’s report had suggested various regulatory options, but the decision-making process did not start until the meeting of 5 January 2012. Mr Pitt-Payne emphasised the crucial nature of the minute of that meeting (at p.16 of the Regulatory Action Recommendation Report, cited at paragraph 29 above). This impermissibly went straight from a finding that the statutory criteria were made out to the conclusion (“therefore”) that an MPN was appropriate, without passing the decision-making square marked “Go” or, in this instance, the express recognition of, and exercise of, the statutory discretion. The meeting of 17 January 2012 was simply to settle the amount of the penalty. The subsequent Notice of Intent similarly failed to address either the existence of, or the exercise of, that discretion. The minute of the final meeting of 24 April 2012, which was convened to consider the Trust’s representations, also took matters no further, nor did the MPN itself. Finally, there was no evidence from the Deputy Commissioner himself as to his approach to the issue of the discretion.[39]Mr Pitt-Payne further submitted that this evidential gap in the Commissioner’s case was compounded by a reasoning gap in the tribunal’s decision. In particular, the tribunal’s conclusion at FTT paragraph [121], quoted at paragraph 35 above, failed to address the Trust’s arguments as to the lack of any evidence to demonstrate that the Commissioner had indeed properly recognised and exercised his discretion.[40]Ms Proops had two principal submissions by way of response. First, she argued that the Trust’s challenge overlooked key factual findings by the tribunal to the effect that the Commissioner had indeed considered whether, and if so how, to exercise his discretion. As well as FTT paragraph [121], she pointed to the tribunal’s other findings, including those that a number of options were “on the table” before the working party (FTT paragraphs [50] and [118]), that Mr Powell’s evidence confirmed that MPNs were not issued in every case (FTT paragraph [109]), that the Trust had in any event accepted that an MPN was inevitable (FTT paragraph [55]), that the Trust’s representations had been considered (FTT paragraph [56]) and that the Deputy Commissioner’s decision to issue an MPN in the circumstances of the case was entirely reasonable (FTT paragraph [122]). Those factual findings by an expert tribunal, she submitted, were unassailable on an appeal to the Upper Tribunal limited to an error of law jurisdiction.[41]Second, and in any event, Ms Proops contended that the tribunal had properly conducted a de novo hearing of the Trust’s appeal, in accordance with section 49 of the DPA, and had independently reached the conclusion that the issue of the MPN in the circumstances of this case was fully justified. Indeed, the tribunal had made it clear not only that the penalty was warranted but that, in its view, the Commissioner’s assessment of the level of that penalty had been on the conservative side. The tribunal explained why it took that view (FTT paragraph [138]), noting that “it seems to us on the facts of this case the IC could have taken a more penal approach to the amount in question”. The Upper Tribunal’s analysis Did the tribunal err in law in its consideration of the discretion ground?[42]In short, the answer to that question is firmly in the negative. The problem with Mr Pitt-Payne’s painstakingly forensic analysis of the evidential paper trail was that it failed to take account of the bigger picture. I hope I am not being unfair when I say that it is rather as if someone tips a 1,000-piece jigsaw out onto a table, throws away the box lid, and then picks up individual pieces to complain that it is impossible to see and understand the overall picture from looking at each of those single pieces.[43]The starting point is the context of the investigation and the Trust’s representations. This was a case where the Trust, acting on professional and presumably either in-house or external legal advice, had conceded that it had had to self-report the contravention as it was, putting it colloquially, “bang to rights”. Its letter of 8 March 2012, providing representations in response to the Notice of Intent, was essentially a damage limitation exercise and no more. As Ms Proops aptly described it, it was “an unqualified confession”. It was thus a plea in mitigation rather than a plea of not guilty.[44]Mr Pitt-Payne argues that this is of no matter; moreover, the Trust’s concession that it would not appeal is neither here nor there, as the data controller’s response cannot detract from the Commissioner’s statutory responsibility to acknowledge and exercise his discretion under section 55A. This is, with respect, unrealistic for the reasons that Ms Proops advanced. In particular, in the context as set out of this case, it is unrealistic to subject the minutes of the Commissioner’s working party and the other documentary evidence to an unduly narrow forensic analysis without looking at the bigger picture.[45]For example, the tribunal found as a fact that the minute of the meeting of 24 April 2012 “records the IC’s decision” (see paragraph 35 above). The record of that meeting is undoubtedly not so much succinct as peremptory (Regulatory Action Recommendation Report, p.18). True, that minute does not expressly advert to the existence of, or exercise of, any discretion. The tribunal recognised that in some respects the internal processes were less than clear (FTT paragraph [123]). Ms Proops also acknowledged that the Commissioner’s staff were on a learning curve in this new jurisdiction. However, the note of that meeting has to be seen in the context of the bigger picture. Although the meeting of 24 April 2012 may have crystallised the Commissioner’s decision, that decision was the result of a drawn-out iterative process which included Mr Powell’s revised recommendation report, narrowing the possible courses of action from seven to three, his confirmation that not all breaches resulted in an MPN, and the working party’s discussion of the features of the case followed by the consideration of the Trust’s representations. Those, in terms, impliedly accepted that the issue of an MPN was indeed a proper exercise of the Commissioner’s discretion.[46]I therefore accept Ms Proops’s first submission that the tribunal both found, and was entitled to find, that the Commissioner had recognised that he had a discretion to exercise under section 55A and had also considered how to exercise that discretion. Did the tribunal err in its approach to its role under section 49 of the DPA?[47]This requires a consideration of the function of the tribunal in hearing an appeal. The starting point is that section 55B(5) of the DPA provides that:
‘(5) A person on whom a monetary penalty notice is served may appeal to the Tribunal against – (a) the issue of the monetary penalty notice; (b) the amount of the penalty specified in the notice.’
[48]Article 7 of the Data Protection (Monetary Penalties) Order 2010 (SI 2010/910) further provides that “Section 49 and Schedule 6 have effect in relation to appeals under section 55B(5) and article 4(5) as they have effect in relation to appeals under section 48(1)” of the DPA. Section 49(1) and (2) in turn provide as follows:
‘(1) If on an appeal under section 48(1) the Tribunal considers— (a) that the notice against which the appeal is brought is not in accordance with the law, or (b) to the extent that the notice involved an exercise of discretion by the Commissioner, that he ought to have exercised his discretion differently, the Tribunal shall allow the appeal or substitute such other notice or decision as could have been served or made by the Commissioner; and in any other case the Tribunal shall dismiss the appeal. (2) On such an appeal, the Tribunal may review any determination of fact on which the notice in question was based.’
[49]At this stage I should note that before the tribunal below, but not before the Upper Tribunal, Ms Proops had advanced submissions to the effect that the tribunal had a narrow supervisory jurisdiction under section 49 of the DPA, akin to judicial review. In particular, she contended before the tribunal below that the Commissioner’s exercise of his discretion under section 55A could only be challenged if it was perverse or otherwise unlawful under general public law principles. The tribunal considered counsel’s competing submissions in detail and resoundingly rejected those of Ms Proops (FTT paragraphs [30]-[39]). There has been no appeal or cross-appeal by the Commissioner on that point and, in my respectful view, wisely so.[50]I agree with the tribunal that its broad jurisdiction under section 49 of the DPA is untrammelled by the sorts of technicalities originally suggested by Ms Proops. Indeed, I only have two reservations about the tribunal’s analysis and findings on this jurisdictional question. The first is that the characterisation of the tribunal hearing on appeal as a “de novo” hearing, while accurate, may not be helpful. Rather, I would describe it as “an appeal by way of a full merits review”. The second is that the tribunal declared it had “some sympathy” with Ms Proops’s suggestion that “when considering the evidence we afford considerable weight to the IC’s views”, given the Commissioner’s experience and expertise as the statutory regulator (FTT paragraph [37]). If the tribunal was suggesting that one party to an appeal should be given some sort of evidential head start in an appeal, then it was clearly wrong to do so.[51]Those caveats aside, there is ample authority to support the broad approach adopted by the tribunal. I note that section 49 is in essentially the same terms as, and indeed formed the basis of, the equivalent definition of the tribunal’s appellate function in section 58(1) of the Freedom of Information Act 2000. The scope of that parallel provision was explained by Upper Tribunal

Judge Jacobs in Information Commissioner v Home Office [2011] UKUT 17 (AAC) :

‘57. As to the function of the section, the First-tier Tribunal hears appeals under a variety of legislation. There are various formulations in different legislation, but generally they have in common that the tribunal is required to undertake a fresh consideration of the case on the evidence and arguments put to it. That is what I expect to find in the case of an initial appeal from a decision-maker in a public body, as the tribunal will give the case the first judicial consideration. It is the nature of such an appeal that there is generally no restriction on the issues, evidence or argument that the tribunal can consider. This is, of course, subject to any express or implied limitation. 58. That is what section 58 does. The tribunal is required to consider whether the Commissioner’s decision notice was in accordance with law. That directs attention to the contents of the notice and the scope of the Commissioner’s duty under section 50. And that directs attention to whether the public authority is required to disclose the information. There is nothing in the language of the section or inherent in the nature of the tribunal’s task to limit the scope of that consideration. In other words, the section imposes the ‘in accordance with the law’ test on the tribunal to decide independently and afresh. It is inherent in that task that the tribunal must consider any relevant issue put it by any of the parties. That includes a new exemption relied on by the public authority. 59. I note that under subsection (1)(a) the test is whether the Commissioner’s decision notice is in accordance with the law, not whether it was . That emphasises that the test is undertaken afresh at the time of the hearing. The date as at which it has to be applied was not before me. 60. In summary, the nature of the appeal before the First-tier Tribunal requires it to consider the response that the public authority should have made afresh. It must apply the law afresh to the request taking account of the issues presented at the hearing or identified by the First-tier Tribunal.’
[52]The same approach was adopted in Evans v Information Commissioner (Correspondence with Prince Charles in 2004 and 2005) [2012] UKUT 313 (AAC) , where the Upper Tribunal panel, when deciding an appeal by way of a discretionary transfer from the First-tier Tribunal (Information Rights), accepted submissions (or concessions) by counsel that by way of “convenient shorthand” its role was simply to ‘decide “whether the decisions of the Commissioner were right”’ (at paragraph 20).[53]I do not regard this perspective on the First-tier Tribunal (Information Rights)’s appellate function as being in any way weakened Davis LJ’s subsequent comment in the Divisional Court in R (on the application of Evans) v HM Attorney General & Anor [2013] EWHC 1960 (Admin) to the effect that, under section 58, “while a hearing before the tribunal is not stated to be a complete rehearing in respect of what eventuated before the Information Commissioner, it is quite close to it” (at paragraph 30). The focus of those judicial review proceedings was elsewhere and did not concern the precise scope of section 58 (and by analogy section 49).[54]Furthermore, therefore, it follows that I am unreservedly with Ms Proops when she submits that under section 49 of the DPA what matters is whether or not the tribunal itself, having heard and reviewed all the evidence, decided that it was appropriate for the Commissioner to have issued an MPN. Reading the tribunal’s decision as a whole, it is absolutely clear that the tribunal concluded, as part of a “de novo” or “merits review” appeal, that the statutory criteria under section 55A of the DPA had been met (indeed this was not contested), that it was appropriate to issue an MPN and that the amount of the penalty was appropriate (even if the tribunal itself regarded that amount as towards the low end for the level of appropriate penalty). These conclusions are set out clearly in various passages in the tribunal’s decision (see e.g. FTT paragraphs [37], [63], [105]-[124], [138]-[139] and [157]).[55]Ms Proops’s analysis also fits more comfortably with the tribunal’s powers under section 49 of the DPA. If the tribunal considers that either (or both) of section 49(1)(a) and (b) is met, then “the Tribunal shall allow the appeal or substitute such other notice or decision as could have been served or made by the Commissioner; and in any other case the Tribunal shall dismiss the appeal”. Counsel agreed that the only sensible way to read the first “or” in this passage is as “and/or”, which I accept. However, an important feature of the tribunal’s appellate jurisdiction is that it has no express statutory power to remit the matter back to the Commissioner for a fresh decision (even if, as counsel explained, the matter might be adjourned for further discussions between the parties, which might end up in the same place; the issue as to whether the tribunal has a power of remittal is currently under appeal to the Upper Tribunal in GIA/1382/2013). In addition, the tribunal has the express power to “review any determination of fact on which the notice in question was based” (section 49(2)). Taking those provisions together, the objective of the legislation must surely be to provide a “one stop” appellate shop, allowing the tribunal to resolve the matter once and for all, often having had the advantage of hearing oral evidence which would not have been available in the paper-based proceedings before the Commissioner. Thus, to paraphrase and adapt the position taken in Evans v Information Commissioner , the tribunal’s function under section 49 was to decide whether the Commissioner’s decision to issue an MPN and the amount of the penalty was right. The tribunal in this case did just that.[56]If there is a criticism to be made of the tribunal’s approach in this case, it is that the structure of its decision and reasoning at times makes it a little difficult to distinguish between its review of the Commissioner’s internal decision-making processes and its own analysis of the merits of imposing an MPN on the Trust (although, for the reasons set out above, I am satisfied that the tribunal made that distinction). In fairness, however, this was in large part a response to the way in which the parties had pleaded and argued their respective cases before the tribunal below. Future tribunals hearing appeals against MPNs would be well advised to start with the legislative conditions under section 55A and examine whether those conditions have been met, on a proper understanding of the relevant law as applied to the facts as they find them to be, and go on to consider whether the Commissioner’s discretion should have been exercised differently, rather than painstakingly following all the twists and turns of the Commissioner’s internal decision-making processes.[57]The “discretion” ground of appeal accordingly fails. Ground 3: the discount ground The option for an early payment discount[58]The MPN, issued on 27 April 2012, set the monetary penalty at £90,000, using the same language as had appeared in the Notice of Intent, namely that this was “reasonable and proportionate given the particular facts of the case and the underlying objective in imposing the penalty.” The MPN also specified that payment had to be made by 29 May 2012 but included the following proviso:
‘ Early payment discount If the Commissioner receives full payment of the monetary penalty by Monday 28 May 2012 the Commissioner will reduce the monetary penalty by 20% to £72,000 (Seventy two thousand pounds).’
[59]The Trust offered to pay £72,000 within the specified time on the understanding that payment would be without prejudice to its right of appeal and that payment would be refunded if the appeal succeeded. The Commissioner declined to accept payment on that basis, arguing that the Trust had to elect between taking the benefit of the discount and exercising its right to appeal. The tribunal’s approach to the case put by the Trust[60]Mr Pitt-Payne’s central submission on this ground of appeal was that the Commissioner had erred in law by in effect subjecting the Trust to a financial penalty for exercising its right of appeal. The tribunal dealt with that submission as follows:
‘153. The purpose of the scheme would appear to us to encourage early payment and also to ensure there is an early resolution to the matter. There is no provision for a without prejudice payment. 154. The failure of the IC to accept the without prejudice offer outside the basis of the MPN guidance does not seem to us to amount to an error of law and/or wrong exercise of discretion. At most the MPN guidance is a quasi judicial obligation on the IC to provide a discount on specific terms. He did so in this case. The Trust chose not to accept the terms and it is its loss when an appeal fails. 155. We note that such a discount for early payment is offered under other regimes like parking and minor road traffic offences. We are not aware that an offender can reserve his position if he decides to appeal.’
The parties’ submissions before the Upper Tribunal[61]On this further appeal, Mr Pitt-Payne submitted that putting the Trust to an election in this way amounted to an interference with the Trust’s statutory right of appeal, which could only be justified if there was a clear legislative basis – but there was none. Thus there was nothing in either section 55B (MPNs: procedural rights) or section 55C (Guidance about MPNs) of the DPA which provided any statutory warrant for a data controller being subject to a financial penalty for exercising the right of appeal conferred under the Act. Furthermore, there was nothing in the Commissioner’s statutory Guidance about the issue of monetary penalties (2012) to indicate that the benefit of a discount was forfeited if an appeal was lodged; that statutory guidance simply referred to a standard discount of 20 per cent for payment within 28 days (at paragraph 7.4, p.29). In addition, it was wrong to suggest that the practical benefit of the early payment discount would be undermined if payment was made subject to the right of appeal. This was because the money would be in the Commissioner’s hands, and so there would be no need for what might be protracted and ultimately unsuccessful proceedings for enforcement of the MPN under section 55D, bearing in mind that not all data controllers would necessarily act responsibly.[62]Ms Proops developed two lines of argument. First, she made a vires point, namely that the Trust was actually challenging not the MPN itself but rather the Commissioner’s subsequent decision not to accept its “conditional offer”. Furthermore, she submitted, this was in reality a challenge to the early payment discount scheme, not the MPN, and the appropriate route for that was by way of an application for judicial review in the Administrative Court rather than on appeal to the Upper Tribunal. Second, and in any event, she contended that the Trust’s approach was fundamentally misconceived – the early payment discount scheme, properly construed, was not a fetter on the right of appeal. It simply provided an opportunity for a data controller who was in breach to trade its right of appeal for a substantial reduction in the amount of the penalty. There was no provision in the Act, the secondary legislation or the statutory guidance enabling provisional payments subject to any appeal and for a clawback in the event of that appeal succeeding. There were also, as the tribunal recognised, strong public policy reasons which supported the early payment discount option. The Upper Tribunal’s analysis[63]I do not accept Ms Proops’s first submission on this ground of appeal. If Ms Proops is right in arguing that the challenge here falls outside of section 55B(5) (on which see paragraph 47 above), then the Trust, as well as appealing to the Upper Tribunal, should have commenced parallel judicial review proceedings in the Administrative Court. This would be a thoroughly unhelpful bifurcation of the challenge, albeit that it could be remedied by the High Court making a discretionary transfer of those judicial review proceedings to the Upper Tribunal under section 31A(3) of the Senior Courts Act 1981 (as inserted by section 19(1) of the Tribunals, Courts and Enforcement Act 2007). In my view, however, section 55(5)(b) is expressed sufficiently broadly to include a challenge to the fact that the amount of the penalty is £72,000 if paid within 28 days but £90,000 if it is not. I therefore agree with Mr Pitt-Payne that I should adopt a purposive construction of the legislation which avoids what he aptly described as the mischief of “procedural Balkanisation”.[64]I accept, however, Ms Proops’s second line of argument, essentially for the same reasons as found favour with the tribunal. The fact that the legislation and the statutory guidance is silent on the matter does not take us very far; certainly on one view there is no provision for a conditional or provisional payment and the mechanics of how any such clawback would work are not clear. In my view the tribunal properly identified a very significant public policy argument which justifies the operation of an early payment discount scheme – the early payment and early resolution of the issue. Moreover, as Ms Proops submits, there is a strong public interest in disincentivising data controllers from mounting ill-founded appeals. This is a far more telling consideration than Mr Pitt-Payne’s point that, on his analysis, the Commissioner would be spared the inconvenience of launching section 55D proceedings for a sub-set of recalcitrant data controllers.[65]In the course of argument I put it to Mr Pitt-Payne, rather teasingly, that the Trust was trying to have its cake (i.e. keep the benefit of the discount) and eat it (i.e. exercise its right of appeal). I have to say that despite his sterling endeavours he did not persuade me otherwise. I found it telling that he did not refer me to any authority but rather relied on statements of general principle. The Trust as a ‘core’ (as opposed to hybrid) public authority cannot claim the benefit of the Human Rights Act 1998 and the European Convention on Human Rights ( Aston Cantlow v Wallbank [2004] 1 AC 546 at paragraph 8 per Lord Nicholls of Birkenhead). I have therefore considered the issue as a matter of first principles.[66]It is a fundamental tenet of the common law that a person’s recourse to the courts (and by inference, where statute so provides, tribunals) for the determination of their rights cannot be excluded except by clear words ( Pyx Granite Co Ltd v Ministry of Housing and Local Government [1960] AC 260 at 286 per Viscount Simonds). However, Mr Pitt-Payne rightly did not seek to suggest that this right of access was being excluded or ousted; rather, he submits, its exercise is being made subject to an unwarranted fetter or restriction.[67]According to Bennion on Statutory Interpretation , “the right of a person to bring, defend, conduct and compromise legal proceedings without unwarranted obstruction is a basic right of citizenship” (F. Bennion, 5 th edition, 2008 at p.854, citing In re the Vexatious Actions Act 1896 – in re Bernard Boaler [1915] 1 KB 21 at 34-35 per Kennedy L.J.). The leading modern authority is perhaps R v Lord Chancellor ex parte Witham [1997] 2 All ER 779 , where Laws J. (as he then was) held as follows (at paragraph 27):
‘Access to the courts is a constitutional right; it can only be denied by the government if it persuades Parliament to pass legislation which specifically - in effect by express provision - permits the executive to turn people away from the court door.’
[68]On the particular facts of that case, where the litigant was on benefit and legal aid was not available for the class of action in question, but he was required to pay court fees, the Divisional Court found that there had been just such a denial of access to the courts. That is a long way removed from the present situation.[69]In the course of argument I also raised the possible analogy between the early payment discount option under the MPN scheme and the discount for defendants who tender guilty pleas in the criminal courts. Mr Pitt-Payne sought to distinguish that latter scenario as the principles governing such reductions in sentences are governed by a detailed legal framework (in case law and sentencing guidelines); moreover, a guilty plea spares the victim (and indeed witnesses) having to go through the ordeal of giving evidence. As indicated above, I do not find the silence of the legislative framework for the early payment discount scheme significant. The Commissioner, as regulator, has adopted a straightforward discount scheme which is both simple and transparent, being advertised both in the guidance and the MPN itself. The credit for pleading guilty and so protecting the victim is simply another illustration of a significant public interest – the nature of that interest will inevitably depend on the context.[70]Putting the example of the guilty plea to one side, the better analogy is arguably that identified by the tribunal, namely the type of fixed penalty notice which exists in (or sits alongside) the criminal justice system for e.g. minor motoring contraventions, littering and other types of anti-social behaviour. As the tribunal intimated, the typical fixed penalty notice involves the person in breach being given the mutually exclusive options of paying a fine within e.g. 28 days, in which event the enforcement authority treats the matter as closed (and in effect undertakes not to prosecute), or alternatively requesting (or being summonsed to attend) a court hearing with the potential prospect of a heavier fine if found guilty. I am not aware of any case law, and certainly none was cited to me, that has ruled such arrangements to be an unwarranted fetter on the citizen’s right of access to the criminal courts. As Ms Proops submitted, if those various arrangements in or closely allied to the criminal justice system are accepted, the early payment discount scheme can hardly be regarded as objectionable, existing as it does in a civil penalty context.[71]I conclude that the early payment discount scheme, properly construed, does not act as a fetter on the statutory right of appeal. If I am wrong about that, then it is not an “ unwarranted obstruction” of that right, to use Bennion’s terminology (emphasis added). I therefore find no error of law in the approach adopted by the tribunal. Ground 4: the quantum ground Assessing the right level of penalty[72]The legislation simply sets a ceiling of £500,000 on the level of the MPN (see section 55A(5) and paragraphs 10 and 13 above). It gives no guidance as to how the assessment process is to be carried out or indeed the principles that are to apply.[73]The Commissioner’s statutory guidance gives general pointers as to the types of issues that will be relevant to deciding the appropriate level of an MPN (see Guidance about the issue of monetary penalties (2012), paras. 4.1-4.3, pp.21-23). A further publication Framework for determining the appropriate amount of a monetary penalty (31 January 2011) sets out a “seriousness rating” as follows:
‘Serious = £40,000 to £100,000 Very serious = more than £100,000 but less than £250,000 Most serious = more than £250,000 up to the maximum of £500,00 Once the level of seriousness has been determined, the starting point will be set at the mid-way point within each band.’
The tribunal’s approach to the case put by the Trust[74]The Trust’s case in this respect before the tribunal was that the Commissioner had given insufficient credit to the Trust for the various mitigating features of the case. Thus to that extent it was argued that the Commissioner had not acted in accordance with the law and/or he should have exercised his discretion differently within the terms of section 49 of the DPA.[75]The tribunal rejected the Trust’s related challenge that the Commissioner had failed to take proper account of mitigating features when deciding to impose a penalty in the first place (FTT paragraphs [125]-[129]). The tribunal also rejected the further argument that the Commissioner had failed to take proper account of such mitigation when setting the amount of the penalty (FTT paragraphs [141]-[149]). The parties’ submissions before the Upper Tribunal[76]Mr Pitt-Payne’s primary submission on the “quantum” ground was that both the Commissioner and the tribunal had erred in their approach to setting the appropriate level of the penalty. Had they not so erred, he argued, the MPN would have been set at a lower level than £90,000. Mr Pitt-Payne’s secondary submissions were essentially two-fold. First, the Commissioner and the tribunal had both treated the serious nature of the breach, the likelihood of causing substantial distress and the Trust’s negligent behaviour as aggravating features of the contravention, when these were simply the preconditions for imposing an MPN in the first place. Second, the Commissioner and the tribunal had assumed that no hardship would ensue, as public money was involved, and had failed to have regard to the effect on the services provided by the Trust.[77]Ms Proops sought to put this challenge in context in two ways. First, the penalty was just less than one-fifth of the maximum permissible under the MPN regime. Second, and as already noted, the tribunal took the view that the penalty was arguably on the low side (see paragraph 41 above). She further resisted both of Mr Pitt-Payne’s secondary lines of argument. It was, she submitted, absurd to suggest that the Commissioner (and, by implication, the tribunal) could not calibrate the amount of the penalty by reference to the nature of the contravention and its effect on data subjects. Likewise, there was simply no evidence before the Commissioner or the tribunal as to the likely effect, if any, on service provision. The tribunal, she argued, had made unassailable findings which could not be disturbed on appeal. The Upper Tribunal’s analysis[78]The Trust had advanced various mitigating arguments, both in its representations to the Commissioner in response to the Notice of Intent and before the tribunal. The tribunal dealt with these arguments at two stages of its analysis (see paragraph 75 above).[79]First, it was satisfied that the Trust’s arguments had been considered, given the evidence in the documentary paper trail (FTT paragraph [126]). The tribunal also explained why the fact that the Trust had self-reported the breach could not carry much weight in the circumstances of this case (FTT paragraph [128]). Indeed, in the context of the decision to impose an MPN, the tribunal noted that the mitigating aspects “are almost all post facto events and nothing about the wrongdoing” (FTT paragraph [128]).[80]Second, the tribunal addressed and rejected Mr Pitt-Payne’s submission that the Commissioner had wrongly relied on the matters which were pre-conditions for liability as aggravating factors in assessing the level of the penalty. Rather, the tribunal was satisfied that the various behavioural aspects had been properly considered, both as regards aggravating and mitigating features (FTT paragraphs [143]-[144]). Furthermore, the tribunal explicitly dealt with and rejected the belated argument that the impact on service provision had been wrongly disregarded (FTT paragraphs [145]-[146]).[81]I can do no better than adopt the tribunal’s reasoning on this point. The tribunal found, and on the evidence was plainly entitled to find, that the Commissioner had considered the various aggravating and mitigating features. The tribunal also independently found, and was entitled to find, that the level of the penalty was within a reasonable range (even if at the low end). In those circumstances the tribunal’s decision cannot possibly be disturbed on an appeal to the Upper Tribunal confined to the error of law jurisdiction. I therefore dismiss the “quantum” ground of appeal. The outcome; and can the Upper Tribunal increase the level of the penalty?[82]I therefore dismiss the Trust’s appeal. The short answer to the further question of whether the Upper Tribunal can increase the penalty, in the particular circumstances of this case, is therefore in the negative. The tribunal’s decision (and the Commissioner’s monetary penalty notice) stands unaffected.[83]I heard some argument as to the Upper Tribunal’s powers on appeal. Much of this was contingent on which, if any, grounds of appeal were to succeed, and so need not be rehearsed in detail here, given the eventual outcome. However, Mr Pitt-Payne submitted that the Upper Tribunal could not increase the amount of the MPN on appeal, given that the Commissioner did not invite the tribunal to increase the penalty and the tribunal did not consider increasing the amount of the penalty of its own motion (Mr Pitt-Payne’s skeleton argument actually refers to the Commissioner not considering “increasing the penalty of its own motion”, but from the context I take this as a reference to the tribunal). Ms Proops, however, argued that if the Upper Tribunal were to re-make the decision under appeal, then it enjoyed all the powers of the tribunal at first instance, which included increasing the level of the penalty.[84]As a matter of principle, and bearing in mind the appellate framework in section 49 of the DPA and section 12 of the Tribunals, Courts and Enforcement Act 2007, I agree with Ms Proops’s analysis. However, as she conceded, and as the tribunal found, as a matter of procedural fairness the data controller would then, of course, have to be given a proper opportunity to make representations if an increase were to be considered (FTT paragraph [39]).[85]There may well be issues in other cases about whether it is appropriate for the Upper Tribunal to re-make the decision or to remit it to the First-tier Tribunal for re-hearing. However, those issues do not arise here and need not be explored further. Conclusion[86]I therefore conclude that this appeal must be dismissed. Signed on the original Nicholas Wikeley on 08 November 2013 Judge of the Upper Tribunal

Cited in 7 later judgments