A now-closed pharmacy business that received the UK’s first ever penalty for breaching the General Data Protection Regulation (GDPR) has failed in a new appeal attempt five years on from its initial £275,000 fine.

In a decision issued yesterday (December 9), three Court of Appeal judges rejected an appeal from the owner of Doorstep Dispensaree Limited (DDL) against a June 2023 tribunal decision that quashed a third appeal attempt concerning the penalty, which was reduced to £92,000 three years ago. 

Doorstep Dispensaree Limited (DDL), a London-based pharmacy that delivered medicines to care homes from its Edgeware headquarters, was first fined in December 2019 after the MHRA executed a search warrant in July 2018, seizing documents stored in bags, boxes and unlocked crates. 

The data was stored at a property in Harrow used by DDL’s sole director, Sanjay Budhdeo, for another business named Joogee Pharma Limited, a licensed waste disposal company. 

Out of 73,719 documents, 53,871 were found to contain private health data and 12,497 included other personal data. The documents had not been protected appropriately, with some found “soaking wet” and mould detected in some of the boxes. 

In addition to its concerns about how special category data was stored, the Information Commissioner’s Office (ICO) uncovered issues with DDL’s data protection policies which it said were “vague” and had not been updated to comply with the GDPR legislation introduced in May 2018. 

In August 2021, the £275,000 fine levied by the ICO was reduced to £92,000 on appeal. 

However, the latest appeal attempt – which challenged Justice Moira Macmillan’s approach to the case when considering the appeal last summer – was roundly rejected by Lord Justice Newey, Lady Justice Asplin and Lord Justice Stuart-Smith.

They rejected Mr Budhdeo’s claims that Justice MacMillan had erred in ruling that the burden of proof rested with him and not the ICO, and that the judge “should not have attached any weight to the [ICO’s] decision”.

UK information commissioner John Edwards said: “I welcome the Court of Appeal’s judgment in this case as it provides clarity for future appeals. 

“We defended our position robustly and are pleased that the court has agreed with our findings.” 

Mr Budhdeo’s solicitors have been approached for comment.