Burden of Proof -- Why It Falls on the Issuer

In CIFAS marker disputes, the burden of proof falls on the organisation that filed the marker. They must justify why the marker was placed, you do not have to prove you are innocent. This is a fundamental principle that many people misunderstand.

The institution placed a record on a national database alleging fraud. They must be able to demonstrate that this allegation is supported by evidence. If they cannot, the marker should be removed.

At the FOS, the ombudsman will ask the institution to explain the basis for the marker and provide their evidence. If the institution's evidence is weak, incomplete, or does not demonstrate dishonesty, the ombudsman can order the marker to be removed.

Our analysis of 1,313 unique published FOS decisions shows that markers are frequently overturned where the institution cannot adequately demonstrate the evidence supporting the marker. The complaint does not need to prove innocence. It needs to show that the institution's case is insufficient.

At court, the position is even stronger. Under UK GDPR, the data controller (the institution) bears the burden of demonstrating that the personal data is accurate. If they cannot prove the marker accurately reflects what happened, the court can order its removal and award damages.

The practical implication is that your complaint does not need to prove you are innocent. It needs to show that the institution's case is insufficient. Ask them, in writing, to identify the specific evidence they hold and explain how it meets each pillar of CIFAS Principle 4. Require them to disclose what human review took place, what the reviewing officer concluded, and on what basis.

Where they respond with a generic refusal that does not address the evidence question, that response itself strengthens the case at FOS and court stage. An institution that cannot explain its evidence when formally asked is in a weaker position than one that provides a reasoned response.