First-tier Tribunal (General Regulatory Chamber)

Appeal number:     EA/2018/0265

       

 

 

FIRST-TIER TRIBUNAL

GENERAL REGULATORY CHAMBER

INFORMATION RIGHTS

 

	DOORSTEP DISPENSAREE Ltd	Appellant
	- and -
	THE INFORMATION COMMISSIONER	Respondent

 

 

TRIBUNAL:	JUDGE ALISON MCKENNA (CP)
	SUZANNE COSGRAVE ALISON LOWTON

 

Sitting in public at Alfred Place London on 24 January 2019

 

For the Appellant: Steven Hayden, counsel

For the Respondent, Peter Lockley, counsel

 

 

 

DECISION

 

 

1.     The appeal is dismissed.

 

REASONS

     Background

2.      This appeal concerns an Information Notice served by the Information Commissioner (“the Commissioner”) on the Appellant company on 25 October 2018.  The Commissioner’s power to serve an Information Notice [1] , and the right of appeal to this Tribunal [2] , were introduced by the Data Protection Act 2018 (“DPA 2018”) [3] .  This is the first appeal to reach final determination under the new regime.  We are grateful to Mr Lockley on behalf of the Information Commissioner and to Mr Hayden on behalf of the Appellant for their helpful oral submissions.

3.      The Information Commissioner is currently investigating the Appellant’s compliance with the General Data Protection Regulation (“GDPR”) [4] , in relation to which she is the UK supervisory authority [5] . The Commissioner’s investigation was opened following a report to her office from the Medicines and Healthcare Products Regulatory Agency (“MHRA”) in July 2018 about the manner in which the Appellant company was apparently processing personal data.

4.     The Commissioner requested in correspondence certain information from the Appellant in connection with her investigation.  The Appellant in correspondence refused to provide the requested information and so the Commissioner decided to serve the Information Notice.  

5.     The Appellant appealed to the Tribunal.  The lodgement of the Notice of Appeal has the effect of suspending the Appellant’s obligation to comply  with the Information Notice, pending determination of this appeal [6] .  If the appeal is dismissed, the Commissioner may bring enforcement proceedings in a court. [7]

6.       The Tribunal heard submissions from both counsel and, by agreement, rose to decide a preliminary issue as to whether the Information Notice was invalid if compliance with its terms involved a risk of self-incrimination by the recipient. We concluded that the Information Notice was not invalid on this basis.

7.     We considered the Appellant’s case in the light of our findings as to the preliminary issue and announced at the hearing that the appeal was dismissed. These are our written reasons under rule 38 of the Tribunal’s Rules [8] . 

The Appellant’s Case

8.       The Appellant’s Notice of Appeal was lodged out of time, but the Tribunal agreed to admit it.  The Appellant requested an oral hearing of the appeal. The Tribunal accepted the Appellant’s witness statements as evidence in chief and did not require oral evidence to be given. 

9.     The Appellant’s Notice of Appeal dated 28 November 2018 relied on two grounds of appeal, as follows.  Firstly, that “ there are criminal investigations into the company by MHRA, as such the proper way to question the company is via the criminal proceedings by way of interview of its representatives under the Police and Criminal Evidence Act. To do otherwise would be in contravention of the criminal code and the Human Rights Act…The questions are intended to assist the MHRA’s criminal investigation and in effect MHRA were using the ICO to assist them without recourse to due process and under the guise of requesting information under the Data Protection Act…” . 

10.    Secondly, “ Non-Disclosure.  The ICO stated that its questioning arose as a result of the MHRA contacting them, but failed to provide, although requested, disclosure as to the root of its concerns or as appropriate disclosure…”. 

11.    At the hearing, Mr Hayden refined the Appellant’s case.  He submitted that the Information Notice was not in accordance with in law, as it was void for breach of s. 143(6) DPA 2018 which provides that the recipient of an Information Notice may not be compelled to incriminate him/herself.   Although the section had not been referred to expressly in the Notice of Appeal or correspondence, he submitted that the question of the Appellant’s right not to self-incriminate had been raised in the grounds of appeal and that, as the Commissioner had been aware that a criminal investigation was on foot, it had been wrong in principle for her to compel the Appellant to answer questions which might provide evidence which could be used against it in criminal proceedings.  The Appellant filed witness evidence including a statement from the Appellant’s solicitor confirming that the company’s superintendent had made no comment when interviewed under caution by MHRA. 

12.   Mr Hayden’s secondary submission was that, if the Information Notice was not void, then the Tribunal should amend it to remove certain questions in the Notice which he submitted would have the effect of compelling self-incrimination. The offending parts were some or all of questions 2, 3, 6 and 7 of the Information Notice.  He confirmed he did not pursue the grounds that disclosure and/or PACE compliance were required.

The Commissioner’s Case

13.    The Commissioner’s Response dated 18 December 2018 opposed the appeal on the following grounds.  Firstly, that the MHRA’s investigation is entirely separate from that of the Commissioner, whose concern (and duty) is to monitor and enforce the application of the GDPR.  It is commonplace for the Commissioner to conduct an investigation at the same time as other statutory agencies, but the Commissioner’s focus is on GDPR/DPA only, and not on the criminal investigation being undertaken by MHRA.  Secondly, that ground two is based on a misunderstanding of the Commissioner’s role and the Appellant’s duty to co-operate with her investigation. Further, that there is no requirement for disclosure by the Commissioner before requiring an answer to an Information Notice.

14.   The Commissioner asked the Tribunal to expedite the hearing of this appeal so as to progress its investigation. The Tribunal set a hearing date on the first available date following the close of pleadings.

15.   In response to the Appellant’s case as put at the hearing, Mr Lockley submitted that Parliament had provided the necessary safeguards in DPA 2018, such that the Appellant was at liberty to raise the issue of s. 143(6) and the risk of self-incrimination in correspondence or in response to the service of an Information Notice.  The Commissioner would then have to consider whether to seek to enforce the Information Notice through a court or to cancel the Notice.  In summary, his submission was that s. 143(6) DPA 2018 was relevant to the Appellant’s obligation to comply with the Information Notice but did not affect the validity of a Notice which had been served.  

16.   As to the suggestion that the Tribunal should amend the Notice, Mr Lockley’s submission was that the Notice was in accordance with the law so the appeal should be dismissed.  He submitted that there were no grounds on which the Tribunal could decide to exercise its discretion differently to that of the Commissioner as there was no evidence before it about the precise scope of the criminal investigation and the report from the MHRA showed clear cause for concern as to the Appellant’s GDPR compliance.

The Law

17.   Section 142 DPA 2018 provides the Commissioner with power to serve an Information Notice as follows:

E+W+S+N.I.

18. This section has no associated Explanatory Notes

(1) The Commissioner may, by written notice (an “information notice”)—

(a)require a controller or processor to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of carrying out the Commissioner's functions under the data protection legislation, or

(b)require any person to provide the Commissioner with information that the Commissioner reasonably requires for the purposes of—

(i)investigating a suspected failure of a type described in section 149(2) or a suspected offence under this Act, or

(ii)determining whether the processing of personal data is carried out by an individual in the course of a purely personal or household activity.

(2) An information notice must state—

(a)whether it is given under subsection (1)(a), (b)(i) or (b)(ii), and

(b)why the Commissioner requires the information.

(3) An information notice—

(a)may specify or describe particular information or a category of information;

(b)may specify the form in which the information must be provided;

(c)may specify the time at which, or the period within which, the information must be provided;

(d)may specify the place where the information must be provided;

(but see the restrictions in subsections (5) to (7)).

(4) An information notice must provide information about—

(a)the consequences of failure to comply with it, and

(b)the rights under sections 162 and 164 (appeals etc ).

(5) An information notice may not require a person to provide information before the end of the period within which an appeal can be brought against the notice.

(6)  If an appeal is brought against an information notice, the information need not be provided pending the determination or withdrawal of the appeal.

(7) If an information notice—

(a)states that, in the Commissioner's opinion, the information is required urgently, and

(b)gives the Commissioner's reasons for reaching that opinion,

subsections (5) and (6) do not apply but the notice must not require the information to be provided before the end of the period of 24 hours beginning when the notice is given.

(8) The Commissioner may cancel an information notice by written notice to the person to whom it was given.

(9) In subsection (1), in relation to a person who is a controller or processor for the purposes of the GDPR, the reference to a controller or processor includes a representative of a controller or processor designated under Article 27 of the GDPR (representatives of controllers or processors not established in the European Union).

(10) Section 3(14)(c) does not apply to the reference to the processing of personal data in subsection (1)(b).

18.Section 143 DPA 2018 (headed “Information Notices: Restrictions”) provides that:

 

(1) The Commissioner may not give an information notice with respect to the processing of personal data for the special purposes unless—

(a) a determination under section 174 with respect to the data or the processing has taken effect, or

(b) the Commissioner—

(i) has reasonable grounds for suspecting that such a determination could be made, and

(ii) the information is required for the purposes of making such a determination.

(2) An information notice does not require a person to give the Commissioner information to the extent that requiring the person to do so would involve an infringement of the privileges of either House of Parliament.

(3) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client, and

(b) in connection with the giving of legal advice to the client with respect to obligations, liabilities or rights under the data protection legislation.

(4) An information notice does not require a person to give the Commissioner information in respect of a communication which is made—

(a) between a professional legal adviser and the adviser's client or between such an adviser or client and another person,

(b) in connection with or in contemplation of proceedings under or arising out of the data protection legislation, and

(c) for the purposes of such proceedings.

(5) In subsections (3) and (4), references to the client of a professional legal adviser include references to a person acting on behalf of the client.

(6) An information notice does not require a person to provide the Commissioner with information if doing so would, by revealing evidence of the commission of an offence expose the person to proceedings for that offence.

(7) The reference to an offence in subsection (6) does not include an offence under—

(a) this Act;

(b)section 5 of the Perjury Act 1911 (false statements made otherwise than on oath);

(c) section 44(2) of the Criminal Law (Consolidation) (Scotland) Act 1995 (false statements made otherwise than on oath);

(d) Article 10 of the Perjury (Northern Ireland) Order 1979 (S.I. 1979/1714 (N.I. 19)) (false statutory declarations and other false unsworn statements).

(8) An oral or written statement provided by a person in response to an information notice may not be used in evidence against that person on a prosecution for an offence under this Act (other than an offence under section 144) unless in the proceedings—

(a)in giving evidence the person provides information inconsistent with the statement, and

(b)evidence relating to the statement is adduced, or a question relating to it is asked, by that person or on that person's behalf.

(9) In subsection (6), in relation to an information notice given to a representative of a controller or processor designated under Article 27 of the GDPR, the reference to the person providing the information being exposed to proceedings for an offence includes a reference to the controller or processor being exposed to such proceedings.

19.  The right of appeal to this Tribunal against an Information Notice is provided by ss. 162 and 163 DPA 2018 as follows:

162 Rights of appeal

(1)      A person who is given any of the following notices may appeal to the Tribunal—

(a)an information notice;

(b)an assessment notice;

(c)an enforcement notice;

(d)a penalty notice;

(e)a penalty variation notice.

(2)A person who is given an enforcement notice may appeal to the Tribunal against the refusal of an application under section 153 for the cancellation or variation of the notice.

(3)A person who is given a penalty notice or a penalty variation notice may appeal to the Tribunal against the amount of the penalty specified in the notice, whether or not the person appeals against the notice.

(4)Where a determination is made under section 174 in respect of the processing of personal data, the controller or processor may appeal to the Tribunal against the determination.

163 Determination of appeals E+W.I.

This section has no associated Explanatory Notes

                         

(1) Subsections (2) to (4) apply where a person appeals to the Tribunal under section 162(1) or (3).

(2) The Tribunal may review any determination of fact on which the notice or decision against which the appeal is brought was based.

(3) If the Tribunal considers—

(a)that the notice or decision against which the appeal is brought is not in accordance with the law, or

(b)to the extent that the notice or decision involved an exercise of discretion by the Commissioner, that the Commissioner ought to have exercised the discretion differently,

the Tribunal must allow the appeal or substitute another notice or decision which the Commissioner could have given or made.

(4) Otherwise, the Tribunal must dismiss the appeal.

(5) On an appeal under section 162(2), if the Tribunal considers that the enforcement notice ought to be cancelled or varied by reason of a change in circumstances, the Tribunal must cancel or vary the notice.

(6) On an appeal under section 162(4), the Tribunal may cancel the Commissioner's determination.

Conclusions

20. We agree with Mr Lockley’s analysis of the new legal framework, which we find to be as follows.  The Commissioner may serve an Information Notice in circumstances where she requires a data controller or processor to provide her with information which she reasonably requires for the purpose of carrying out her functions.  The Information Notice must meet certain procedural requirements.   An Information Notice “ does not require ” a person to provide information which would expose them to criminal proceedings.  The Act does not say that the Commissioner may not serve an Information Notice in such circumstances, or that it is invalid if she does so.  It is difficult to see how Parliament could have intended such an interpretation given that the Commissioner would not generally be privy to the relevant information to allow her to make that prospective judgement.  

21. We are satisfied that the effect of s. 143 (6) DPA 2018 is to permit the recipient of an Information Notice to raise the issue of risk of self-incrimination with the Commissioner on receipt of the Notice.  The Commissioner must then take those submissions into account in deciding whether to apply to a court to enforce the Information Notice or to cancel the Information Notice (possibly serving an amended Notice in its stead).  In this case, the Appellant has provided very limited information to the Commissioner and to the Tribunal about the scope of the criminal investigation and thus the scope for self-incrimination. The Appellant claims to have little information itself at this stage of those proceedings.  However, it is clear from the information provided to the Commissioner by MHRA, and placed before the Tribunal, that whatever else may follow there is an issue as to GDPR compliance which warrants further investigation. We accept that the information requested was reasonably required for the Commissioner’s investigation.

22. The role of the Tribunal is to consider whether the Commissioner’s Notice is not in accordance with the law and/or whether she should have exercised her discretion to serve it differently.   The Tribunal has power to substitute a fresh Information Notice if it allows the appeal. We are satisfied in this case that the Information Notice is in accordance with the law and that the Appellant has shown no basis for finding that the Commissioner should have exercised her discretion differently.  For these reasons, we dismiss the appeal.

23.  We noted at the hearing that we had received no evidence from the Commissioner as to the factors taken into account in making the decision to serve the Notice.  Mr Lockley submitted that they were obvious from the correspondence, but we would have found it helpful to have received a short witness statement from the case officer.

24.   We also noted that neither the Notice itself nor the accompanying letter specifically referred the Appellant to the effect of s. 143(6) DPA 2018, notwithstanding the fact that the Commissioner was aware of a parallel criminal investigation.  We suggest that it would be fair for the standard information given to recipients of Information Notices to refer expressly to s. 143 DPA 2018.

 

 

(Signed)                                                                                                            Dated: 28 January 2019

                                                                                           Promulgation date: 30 January 2019

Alison McKenna

Chamber President

 

© CROWN COPYRIGHT 2019