Wharfedale Facilities Management Ltd, a facilities management and commercial cleaning company, appealed a Penalty Notice issued by the ICO on 1 March 2022 for a fixed penalty sum of £600 for non-payment of the charge due from Wharfedale as a data controller.

Wharfedale requested that the Information Commissioner use his discretion to rescind the fine due to the affect the Coronavirus pandemic had had on the business. Wharfedale said that it had missed the deadline due to the overwhelming level of work involved in reinstating its cleaning contracts after the lockdowns. It also said that payment of the charge was the responsibility of the finance manager who had left the company during the pandemic. He had not received the Commissioner’s Notice of Intent and the company had only received the Penalty Notice. With the large debt built up over the last nine months, Wharfedale said that it could not pay the £600 fine.

The Tribunal took the view that there were unique and quite unusual circumstances pertaining throughout the relevant period due to the exceptional circumstances prevailing because of the pandemic. It was mindful of the periods of lockdown as relevant to the timeline of events. Most of Wharfedale’s clients were nightclubs, which were closed from March 2020 to August 2021. Most staff were therefore furloughed or laid off. Further, the Tribunal accepted Wharfedale’s arguments on the levels of work involved post-lockdown in reinstating its cleaning contracts, recruiting staff, and rescheduling Covid-related debts. Its balance sheets showed large debts of more than nine months’ turnover for which the company had agreed a repayment scheme that will last several years. The evidence also showed that the company had no spare cash.

The Tribunal said that all this constituted unusual and exceptional circumstances and rejected the Commissioner’s argument that the £600 penalty would not cause financial hardship. Accordingly, the Tribunal held that the Commissioner could and should have exercised his discretion differently under s 163 of the Data Protection Act 2018 and reduced the Penalty Notice from £600 to £200. (First-Tier Tribunal (General Regulatory Chamber) Wharfedale Facilities Management Ltd v Information Commissioner (Appeal Number EA/2022/0074/FP) — to read the judgment in full, click here).