Wharfedale Facilities Management Ltd v The Information Commissioner

This decision relates to an appeal brought under section 162 of the Data Protection Act 2018. The appeal is against a Penalty Notice issued by the Information Commissioner (“the Commissioner”) on 1st March 2022 against the Appellant under sections 155 and 158 DPA for a fixed penalty sum of £600 for non-payment of the charge due from the Appellant as a data controller under the Regulations.

The Commissioner defends the appeal. The Appellant considers that this is an appeal which may appropriately be dealt with on the papers. The Commissioner agrees with the Appellant’s proposal.

Under section 137 DPA, regulations may be made prescribing charges to be paid to the Commissioner by data controllers and requiring data controllers to provide the Commissioner with specified information.

The Regulations make provision for these charging and information requirements. (The Regulations were originally made under the equivalent powers in the Digital Economy Act 2017, but are preserved and to be treated as having been made under section 137 DPA by virtue of paragraph 26 of Schedule 20 to the DPA.)

Regulation 2(2) requires a data controller to pay a charge to the Commissioner, within 21 days of the beginning of the relevant charge period, in the sum set out in regulation 3.

Regulation 2(6)(a) provides that the “charge period” means:

Regulation 3(1)(b) prescribes the applicable charge to be: £600 for a tier 2 organisation.

The definitions of the tiers are set out in regulation 3(2). The Appellant does not dispute that it is a tier 2 organisation, as so assessed by the Commissioner.

Section 155(1)(a) DPA provides the Commissioner the power to issue a written notice requiring a person to pay an amount specified in the notice (i.e. a Penalty Notice) if the Commissioner is satisfied that the person has failed or is failing as described in, inter alia, section 149(5).

Section 149(5) describes a failure on the part of a controller to comply with regulations under section 137. The Regulations are regulations under section 137 DPA.

In accordance with the requirement to do so set out in section 158 DPA, the Commissioner has published a document specifying the amount of the penalty for a failure to comply with the Regulations. This document is entitled ‘Regulatory Action Policy’ and is published on the Commissioner’s website.

The Commissioner has specified in his Regulatory Action Policy under section 158 that for a breach of regulation 2(2) the following penalties will be applied: a tier 2 organisation will be the subject of a £600 penalty.

A person who receives a Penalty Notice may appeal it to the Tribunal in accordance with section 162(1)(d) DPA. Such an appeal may be against the issue of the Notice, and/or the quantum of the penalty: section 162(3).

The jurisdiction of the Tribunal is set by section 163 DPA, which materially provides:

The right of appeal to the Tribunal accordingly remains materially the same as the Tribunal’s equivalent jurisdiction under the Data Protection Act 1998. It is a full merits appeal, and the Tribunal stands in the shoes of the Commissioner having regard to the material before it, whether that material had been brought to the attention of the Commissioner.

However, unlike the conditions for Penalty Notices under the 1998 Act, in a Penalty Notice issued for failure to comply with the Regulations, no other statutory pre-conditions are set. It is sufficient simply to establish that there was a failure to comply with the Regulations. There is no separate and additional requirement to establish, for example, that the contravention was serious or that there was a likelihood of damage or distress to data subjects.

The Appellant’s Grounds of Appeal requested that the Commissioner use his discretion to rescind the fine imposed due to the affect the Coronavirus pandemic has had on the business. The Appellant stated that they had missed the deadline due to the overwhelming level of work involved in reinstating the contract cleans.

The Appellant stated that the renewal of the Commissioner’s license was the responsibility of the finance manager who left the company during covid. The Appellant stated that he did not receive the Notice of Intent and only received the penalty notice. The Appellant stated that with the enormous debt built upon over the last 9 months they cannot fund the £600 fine.

The Commissioner referred to the statutory scheme, the Commissioner reminded himself that he is under no obligation to remind any data controller of their legal liabilities to pay a charge. However, as a matter of practice, and to assist controllers, the Commissioner issues reminders of forthcoming liabilities to the contact details on record. Similarly in this case, the Commissioner sent out an email reminder to the Appellant at the address listed on the Commissioner’s register on 29th April 2021. The Commissioner sent a further reminder letter to the Appellant at the address listed on the Commissioner’s register on 20th May 2021. A subsequent email reminder was sent to the Appellant by the Commissioner on 24th June 2021. The Commissioner stated that it is not known whether the Appellant accepts that it had received this information.

The Commissioner sent a Notice of Intent under Schedule 16 to the DPA, along with a covering letter dated 11th October 2021 by post to the company’s registered office address. An additional reminder email was sent on 1st November 2021 to the Appellant company’s generic email address. The email confirmed that the Commissioner had recently served a Notice of Intent to serve a fixed monetary penalty, and reminded the Appellant that payment was urgently required to avoid the penalty fee.

On 9th November 2021, the Appellant’s director responded stating that he would “run through the email with their commercial director”. The Commissioner sent a further email to the Appellant on 10th January 2022 to advise that the registration fee remained outstanding. On 2nd February 2022, the Appellant responded requesting bank details for payment of the registration fee. On the same date, the Commissioner provided the Appellant with the same.

The Commissioner sent a further email to the Appellant on 16th February 2022 to advise that payment had not been received. The Commissioner contended that no response or payment was received. Accordingly, under cover of a letter date 1st March 2022, the Commissioner issued the Penalty Notice to the Appellant by post. The Appellant accepts that it received the Penalty Notice.

The Commissioner stated that nothing in the Notice of Appeal outlines a proper basis to challenge the Penalty Notice. The Commissioner argued that the Appellant has advanced no reasons why It failed to pay the charge by 10th June 2021, or the later date of 1st November 2021. No fault on the part of the Commissioner has been identified or could be attributed. The Commissioner, having reviewed the Appellant’s supporting financial documentation, submitted that the penalty would not cause financial hardship and the penalty amount should remain the same. The Commissioner referred to section 158 to contend that the appeal should be dismissed.

The Tribunal find it is clear from the bundle that the Commissioner made a considerable effort to remind WFM Ltd about the overdue fee. The first three of these efforts, in April, May and June 2021 (per pages B1, B3 and B5 of the bundle) were sent to a person that was no longer in the company's employ. Whilst we accept that the Commissioner had no reason to doubt the accuracy of this information, given that the country was in lockdown (and had been for some time), there was a risk that the named person was either furloughed or no longer employed, as appears was probably the case here. 

Having received no response to the above correspondence, the Commissioner issued a 'Notice of Intent' on 11th October 2021, by post to WFML's registered company address (see page B7-16). There followed a further reminder by email on the 1st of November 2021 (see B17), addressed to the company's generic email address (hello@wharfedale-fm.co.uk). This latter correspondence generated a response from the company director on 9th November 2021, who advised that the matter would be taken up with the commercial director; however, no further or immediate response was received.

It was then two months before the Commissioner initiated further contact, in an email dated 10th January 2022, seeking payment of the registration fee or an update (see B19). The Appellant responded to this email on 2nd February 2022, informing the Commissioner that the commercial director had left early in the same year and requesting bank details for payment (B21). The Commissioner provided payment details the same day (see B22) and within the bundle there is a delivery report for this email, albeit confirming that it was delivered on 16th February 2022, some two weeks later. Having heard nothing further from the Appellant again, the Commissioner sent a reminder by email on 16th February 2022 (see B23). Finally, the Commissioner issued the Monetary Penalty Notice on the 1st of March 2022. (It should be noted that the Appellant subsequently paid the registration fee of £60 on the 23rd of March 2022 (see A33, para.3(3)). The Tribunal take the view that there were unique and quite unusual circumstances pertaining throughout this chronological background due to the exceptional circumstances prevailing because of the Corona Virus Pandemic.

In that regard, the Tribunal are mindful of the periods of lockdown in place across England (where the company resides) as relevant to the timeline of events in this case. On 8^th March 2021 the country commenced a phased exit from lockdown, following what the government termed its 'roadmap out of lockdown'. It was not until 19^th July 2021 (delayed start to step 4) that the part of the entertainment industry relevant to the Appellant's business could begin to open again (see Coronavirus: A history of English lockdown laws - House of Commons Library (parliament.uk)).

In the Grounds of Appeal dated 23rd March 2022 the Tribunal were informed that the company had been significantly affected by the covid lockdowns as most of their clients are nightclubs which were closed from March 2020 until August 2021. As a result, it appears that all but 2 of their staff and management were furloughed or laid off. There is no reason to doubt this unfortunate and unusual scenario.

The actual renewal date (10th June 2021) was during lockdown and the Appellant representative (as named in the Grounds of Appeal), was the sole office operative. During September and October 2021, the Appellant had an:” overwhelming level of work … reinstating the contract cleans … recruiting staff and new management and rescheduling covid related debts”.

The renewal of the ICO licence would have been the responsibility of the finance manager who, it seems left during covid, and the Appellant representative had to take over those responsibilities as well. Again, we find there is no reason to doubt this unfortunate and unusual scenario.

The Appellant explained that the balance sheets show enormous debts of more than 9 months turnover for which the company have agreed an orderly repayment that will take several years. We note that the company has no spare cash to fund the £600 fine and Paul Kinsey, Director is not being paid at all for six months to fund the period of recovery. Again, we find there is no reason to doubt this unfortunate and unusual scenario.

The Appellant attached a copy of Wharfedale Facilities Management Accounts for the period ended 30th March 2021 to the grounds of appeal, these were not signed but were dated 24th March 2022. The Tribunal noted that these were unaudited and that for this period the company was entitled to exemption from audit under section 477 of the Companies Act 2006 relating to small companies.

In his Response, the Commissioner notes ‘the Appellant’s claims to “have no spare cash to pay the £600 penalty” - but submits that this will not cause financial hardship to the Appellant and that the penalty amount should remain the same. Concluding that there is “No reason, still less convincing reason, to overturn the Penalty Notice or vary the amount…”

The Tribunal considered the company’s management accounts. Despite the fact that these are not audited accounts, there is no reason for us to doubt that these were an accurate reflection of the financial position of the company from 01 April 2020 – 30 March 2021.

The Tribunal noted from these accounts that: -

The Tribunal takes note of the Commissioner’s comments that the Tribunal should be very slow to depart from the fixed penalty regime published in accordance with s158 of Data Protection Act 2018 for non-compliance with charges regulations.

Having considered all the information provided by the Appellant in the grounds of appeal and the financial information in the companies’ accounts, specifically the significant impact of the pandemic upon the nightclub industry (which is where the company’s customer base is located), the Tribunal regards all of the above to constitute what are unusual and exceptional circumstances and therefore does not agree with the Commissioner’s conclusion that the imposition of a penalty of £600 will not cause financial hardship.

The Tribunal also notes there is no reference to any previous breaches of the nature of the subject matter of the impugned Penalty Notice, or at all, by the appellant.

For the above reasons, the Tribunal’s view is that the Commissioner could and should have exercised his discretion differently.

As set out section 163 DPA at Paragraph 14 above:

In all the circumstances and for the reasons given above the Tribunal unanimously allows the appeal and substitutes a reduced Penalty of £200.00

Accordingly, the Tribunal hereby substitute the Penalty Notice with a reduction of the sum in the Penalty Notice from £600.00 to £200.00.