2024-12-11 19:31:07
On New Year’s Eve 2019, we reported that the Information Commissioner’s Office had issued its first financial penalty – £275,000 – for breach of GDPR (now UK GDPR), and that the penalty had been imposed on a pharmacy business, Doorstep Dispensaree Ltd.
An MHRA investigation had led to the discovery in a courtyard behind the pharmacy of crates and bags of documents containing personal data, mostly of care home residents. Nearly 12,500 of the documents contained personal data, and over 53,800 contained special category data including medical information and prescriptions.
On appeal to the First Tier Tribunal, the penalty was reduced to £92,000. The size of the penalty took into account the very large number of documents and also that much of the data related to highly vulnerable data subjects.
An appeal to the Upper Tribunal was dismissed. In Doorstep Dispensaree Ltd v Information Commissioner, an appeal to the Court of Appeal ([2024] EWCA Civ 1515) on a point of law concerning the burden of proof has also just been dismissed.