In August 2018 the Open Rights Group, a digital rights organisation that seeks to promote and uphold privacy and data protection rights, and the3million, a grassroots organisation of EU citizens resident in the UK, brought a judicial review claim against the Secretaries of State for the Home Department and Digital, Culture, Media and Sport, seeking a declaration that the "Immigration Exemption" under Paragraph 4 of Schedule 2 to the Data Protection Act 2018, which disapplies some data protection rights where their application would be likely to prejudice immigration control, was unlawful. They argued that the Immigration Exemption was incompatible with the General Data Protection Regulation (206/679/EU) and/or with the Charter of Fundamental Rights of the European Union. The defendants denied both these contentions.
The proceedings were launched when the UK was still an EU Member State and judgment was given after "exit day", 29 March 2019, but during the implementation period provided for by the Withdrawal Agreement, which ended on 31 December 2020. Therefore, the UK's withdrawal from the EU did not materially affect the position.
The claim was dismissed at first instance on the basis that the Immigration Exemption fell within Article 23(1)(e) GDPR. Article 23(1) authorises an exemption from certain rights and obligations under the GDPR by way of a "legislative measure" where it "respects the essence of fundamental rights and freedoms" and is a "necessary and proportionate measure in a democratic society to safeguard" one of the specified objectives (such as public security, judicial proceedings etc.) set out in sub-paragraphs (a) to (j). Article 23(1)(e) covers "other important objectives of general public interest ...". The judge said that the Immigration Exemption was a matter of "important public interest" and pursued a legitimate aim. Therefore it was compliant. The claimants appealed to the Court of Appeal.
The main ground of appeal focused on Article 23(2) of the GDPR, which provides that any legislative measure enacted under Article 23(1) "shall contain specific provisions at least where relevant as to" a list of eight requirements set out in sub-paragraphs (a) to (h). The claimants argued that the judge was wrong to approach the case by reference to principles applicable to Article 8 of the European Convention on Human Rights. They said that CJEU case law and the terms of Article 23(2) itself make clear that the circumstances in which a derogation such as the Immigration Exemption will apply, and under what substantive and procedural safeguards, must be clearly prescribed by the legislation itself and/or appropriate guidance with the force of law, and that the judge was wrong to approach the case on the footing that these matters could lawfully be dealt with in other ways. In other words, they said that the Immigration Exemption was so-over broad as to be in breach of the express requirements governing derogations in Article 23(2) of the GDPR and the CJEU's case law.
Lord Justice Warby noted that although Article 23(1) has a familiar structure, reflected in the Charter and the ECHR, its function is different. Whereas Article 8 of the ECHR (for instance) prescribes the conditions under which state interference with the right to respect for private and family life may be justified, Article 23 is a measure that permits the state to restrict the very scope of the right, including by removing it from the citizen altogether, in specified circumstances.
Further, Warby LJ said, the language and structure of Article 23(2) are not familiar from the Charter, the ECHR, or the Data Protection Directive (95/46/EC). On a natural reading of the words, Article 23(2) particularises the requirements of Article 23(1) and sets out details of what a "legislative measure" must do if it is to comply with the requirements of Article 23(1), i.e. it must "contain specific provisions" about each of the eight listed matters "at least, where relevant" to an assessment of whether the measure respects the essence of the right in question and is necessary and proportionate for one or more of the listed purposes or objectives. The language also clearly suggested that the legislative measure must have some binding force, he said.
As for CJEU case law, in Warby LJ's view this showed that the CJEU: (i) has been alert to the risk of over-broad derogations from fundamental rights; (ii) requires any derogation from fundamental rights to be justified by proof of strict necessity; and (iii) does not consider that this, or the requirement of proportionality, can be satisfied unless the appropriate safeguards are built into the legislative measure itself. This supported his findings on the language of the GDPR. Further, he said, there was nothing in the cases that supported the judge's conclusion that a distinction should be drawn between different kinds of derogation and that different criteria apply to a derogation that is "permissive". The one clear and consistent theme running across the case law was that derogations in this area must be justified as strictly necessary. There was no trace of any doctrine that a less exacting standard might apply where the relevant legislation does not itself involve an abrogation or interference but merely authorises it.
Warby LJ also said that the requirements listed in Article 23(2) were particularised at some length and in some detail. While Article 23(2) did comprise a checklist, it was cast in mandatory terms and called for "specific" provisions, which should surely be given some meaning. In any event, in Warby LJ's judgment, in the light of the CJEU case law, Article 23(2) should be read as requiring any derogation to be effected by a "legislative measure" that is tailored to the derogation, is legally enforceable, contains provisions that are specific to the listed topics (to the extent they are relevant to the derogation in question), is precise, and produces a reasonably foreseeable outcome. The CJEU has repeatedly rejected submissions to the effect that domestic legislation should be held to be legitimate on the basis that sufficient safeguards could be found elsewhere in the overall legal framework.
Warby LJ said that these conclusions were also consistent with the EDPB's Guidelines 10/2020 (paragraphs 45 and 46).
Warby LJ agreed with the judge that the Immigration Exemption addressed an important aspect of the public interest that fell within the scope of Article 23(1)(e). However, he said that the judge had been wrong to reject the claimants' submissions on Article 23(2). Reading Article 23 as a whole, it was clear that the Immigration Exception was non-compliant. The Exemption itself contains nothing, specific or otherwise, about any of the matters listed in Article 23(2). Even assuming, without deciding, that it is permissible for the "specific provisions" required by Article 23(2) to be contained in some separate legislative measure, there was no such measure.
Warby LJ concluded by saying that the appropriate remedy in a case of incompatibility was "a sensitive matter". He therefore deferred a decision on relief, inviting further submissions in the light of his findings. (The Open Rights Group v The Secretary of State for the Home Department [2021] EWCA Civ 800 (26 May 2021) — to read the judgment in full, click here).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
