May 20, 2019

The appellant, Farrow and Ball Ltd, appealed against the decision of the Information Commissioner to issue it with a Penalty Notice of £4,000 in November 2018 for failure to provide the ICO with the information required by regulation 2(3) of the Data Protection (Charges and Information) Regulations 2018 or to pay the Data Protection Fee required by regulation 2(2) by the compliance date of 9 August 2018.

Farrow and Ball argued that its default was an innocent mistake. Farrow and Ball said that: (i) the Information Commissioner should have exercised her discretion differently in relation to the amount of the penalty; (ii) the reminder was sent whilst the appellant’s representative was on holiday and the Commissioner should have issued a further reminder; (iii) the Commissioner wrote to the company secretary but the correspondence was not recognised as important internally; and (iv) the Commissioner was contacted promptly once the error was spotted and the Data Protection Fee was paid immediately. Farrow and Ball said that it had learned from its mistake and had put procedures in place to ensure it would not happen again.

The Commissioner submitted that the penalty regime had been established by Parliament and that there was no requirement to issue reminders (although a reminder was in fact sent in this case). She accepted that the failure to comply with the Regulations was due to an oversight, but submitted that the imposition of a penalty was appropriate in all the circumstances. She noted that Farrow and Ball had been a data controller before the commencement of the Regulations and had paid the relevant fees under the earlier legislation, so should have had relevant administrative systems in place.

The Tribunal decided that Farrow and Ball had not provided a reasonable excuse for its failure to comply with the Regulations. It said that a reasonable data controller would have systems in place to comply with the Regulations and that Farrow and Ball had pointed to no particular difficulty or misfortune that explained its departure from the expected standards of a reasonable data controller.

Further, there was no basis for departing from the Commissioner’s policy to impose a £4,000 fixed fee. Farrow and Ball had not provided any evidence of financial hardship that could affect the penalty. The Tribunal said that it found it difficult to see how the reduction of the penalty could incentivise Farrow and Ball to greater compliance in the circumstances of this case, where human error appeared to have been the main factor.

The appeal was dismissed and the Penalty Notice confirmed. (Farrow and Ball Ltd v Information Commissioner [2019] UKFTT 2018_0269 (GRC) (29 April 2019) — to read the judgment in full, click here).

In a subsequent blog post, the ICO said: “Data controllers are given adequate opportunity to pay the fee to the ICO before they are issued with a fine. Being on holiday is no excuse. However we consider any reasonable representations from organisations in response to our notices of intent to serve a penalty”. To read the blog post in full, click here.