Doorstep Dispensaree, the first UK company to be fined under the GDPR regime, has failed in its fourth – and final – attempt to overturn the penalty in a move that the data watchdog has said “provides clarity for future appeals”.
The Information Commissioner’s Office issued the business with a £275,000 penalty in December 2019 for failing to store “special category data” securely.
At the time, the ICO ruled the firm – which supplies medicines to customers and care homes – left nearly 500,000 documents in unlocked containers at the back of its premises in Edgware.
The documents included names, addresses, dates of birth, NHS numbers, medical information and prescriptions belonging to an unknown number of people.
It originally served the company with a notice of intent for a £400,000 penalty but this was reduced following “representations” made to the regulator.
However, Doorstep Dispensaree still felt hard done by and launched a partially successful appeal at the Upper Tribunal, which saw the fine reduced to £92,000.
But the firm still was aggrieved so it launched a third appeal in an attempt to throw out the fine all together. This too was unsuccessful but the company refused to let it lie and took the case to the Court of Appeal.
In its judgment published today, the CoA rejected both grounds for appeal brought by the business. The Court found that the burden of proof in an appeal lies with the appellant and subsequent tribunals and appeal courts are not required to start considering an appeal with a ‘blank sheet of paper’, essentially ignoring the monetary penalty notice.
The ICO insists the case raised issues of considerable importance for ongoing and future appeals of penalties issued.
UK Information Commissioner John Edwards said: “I welcome the Court of Appeal’s judgment in this case as it provides clarity for future appeals. We defended our position robustly and are pleased that the Court has agreed with our findings.”
Related stories
Doorstep Dispensaree pays up for endless GDPR appeals
First UK firm hit under GDPR has fine cut by nearly 70%
ICO issues first GDPR fine, but it’s not BA or Marriott
GDPR penalties near €4bn in EU after ‘double busy’ H1
Revealed: Data breaches which will get the ICO calling
Be the first to comment on "Doorstep Dispensaree GDPR appeal fails for final time"