Court of Appeal of the United Kingdom holds the ‘immigration exemption’ under the Data Protection Act 2018 as unlawful
On May 26, 2021, the Court of Appeal of the United Kingdom handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the immigration exemption provided under Schedule 2, paragraph 4 of the United Kingdom’s Data Protection Act 2018 is unlawful.
Overview of this case
Under Art. 23 of the General Data Protection Regulation (‘GDPR’), EU Member States are permitted to create exemptions in their national law from some GDPR obligations on the grounds of, for example, national security and public interest. Any such exemption must respect the essence of the fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society. Further, such exemptions implemented in the national laws should also include provisions relating to its purpose, scope, safeguards and risks (among other provisions).
This case was concerned with the lawfulness of statutory restrictions on data protection rights, in the context of immigration. The immigration exemption enacted under Schedule 2, paragraph 4 of the DPA 2018 (Data Protection Act 2018 is UK’s national law on data protection and includes some exemptions.), permits those processing personal data for the following purposes to be exempt from complying with the data subject rights guaranteed by the GDPR:
(a) for the maintenance of effective immigration control, or
(b) for the investigation or detection of activities that would undermine the maintenance of effective immigration control,
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).
This exemption was heavily relied on by the Home Office. Evidence provided disclosed that the Immigration Exemption was relied on in 59% of its responses. The appellants provided strong statistics from the review for the Independent Chief Inspector of Borders and Immigration in 2016 revealing that in 10% of cases where a search of the Home Office database identified an individual as a „disqualified person“ who should be refused a bank account, the answer was wrong. There were also mistaken omissions. Further, the success rate for appeals against Home Office immigration decisions was 47%.
Although, this exemption provides information on the purposes for which this may be applied, it does not contain any specific information or otherwise on the matters listed under Art. 23(2) GDPR. The court stated that the Art. 23(2) GDPR itself, makes clear the circumstances in which a derogation such as the Immigration Exemption will apply, and under what substantive and procedural safeguards, must be prescribed by the legislation itself.
The appellants argued that this exemption was incompatible with the GDPR and/or with the Charter of Fundamental Rights of the European Union of 7 December 2000 („the Charter“). As is obvious from the Art. 23(2) GDPR, the legislative measure has to “contain specific provisions“ about the eight listed matters „at least, where relevant“. Such provisions are not provided in the immigration exemption under Schedule 2, paragraph 4 of the DPA 2018 which means that this provision of the Data Protection Act 2018 is non-compliant with the Art. 23 GDPR.
The Court of Appeal, thus, determined that while the exemption did address an important public interest, it did not include the required provisions and limitations, thereby, holding this exemption as being ‘unlawful’.
Brexit and hopes for an adequacy decision
The timing of the adequacy bridge coming to an end later this month (i.e., end of June), this judgment holding provision of UK’s national data protection law as being incompatible with the EU law and skepticism for UK’s data protection practices by the European Parliament puts UK’s hope for adequacy decision in a hardship.
On May 21, 2021, MEPs voted on a resolution (344 votes in favor, 311 against and 28 abstaining), asking the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there. Interestingly enough, one of the issues raised concerns this very exemption in the field of immigration.
Taking into consideration, the current legal and political ambience surmounting UK’s data protection regime, this judgment is likely to have wider implications for the adequacy determination sought by the UK from the European Commission.