Open Rights Group – Court Ruling (United Kingdom, 2021)

The two claimants are The Open Rights Group and The3million, who are respectively a UK-based digital campaigning organisation working to protect the rights to privacy and free speech online and an organisation campaigning for EU citizens in the UK. In August 2018, they brought a judicial review claim against the lawfulness of the immigration exemption in paragraph 4, Schedule 2, of the Data Protection Act 2018 ('DPA 2018'), which was brought into force on 25 May 2018 ('Immigration Exemption'). They argued that the Immigration Exemption is contrary to Article 23 GDPR and incompatible with the rights guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the EU. [https://www.bailii.org/ew/cases/EWHC/Admin/2019/2562.html The High Court (Admin) judge dismissed these claims]. The claimants appealed this decision, which [https://www.bailii.org/ew/cases/EWCA/Civ/2021/800.html the EWCA allowed in May 2020]. At this stage of the appeal, it held the “Immigration Exemption” was indeed contrary to Article 23 GDPR. It nonetheless did not decide what form of relief should be granted at that stage, because this issue raised legal issues that needed to be carefully assessed in separate proceedings. As such, the decision on relief was deferred to this case. To decide what form of relief it should grant the claimants, the EWCA first analysed whether it (1) had jurisdiction to suspend relief for a period of time and, if so (2) whether/to what extent/for how long it should exercise it. = The EWCA first stated that the UK GDPR is retained EU law and therefore has supremacy over domestic primary legislation. It nonetheless explained that this does not entitle the court "to make a quashing order in respect of primary legislation", as this would be constitutionally improper, but only to "make a declaratory judgment or order". It summarised the test to be followed, which essentially mirrors the provisions in [https://www.legislation.gov.uk/ukpga/2018/16/section/6 section 6 EUWA]. In sum, it held that it has the power to delay or suspend the implementation of a dominant rule of (retained) EU law, and the consequent disapplication of an inconsistent domestic provision. It limited this power in light of existing CJEU/UK jurisprudence: * First, it referred to [https://curia.europa.eu/juris/document/document.jsf;jsessionid=AF5F022BBBBCFC2D08884734FA35CC2C?text=&docid=235490&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=8955 La Quadrature] to qualify that the power is limited to permitting a temporary suspension, and should be exercised only exceptionally, on the basis of "overriding considerations of legal certainty". It stated "the interests of legal certainty must be so compelling that it is necessary for them to take priority over the need to implement the dominant legal provision, and disapply the subordinate law" - a strict test. * Second, it referred to [https://www.bailii.org/ew/cases/EWHC/Admin/2018/975.html Liberty] to rule that that not only the decision to suspend but also the duration of any suspension needs clear justification, as "it would not be just or appropriate for the Court simply to give the Executive a carte blanche to take as long as it likes in order to secure compliance with EU law. The continuing incompatibility … needs to be remedied within a reasonable time." * Third, it referred to [https://curia.europa.eu/juris/document/document.jsf?text=&docid=230249&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=11062 Gewestelijke] to emphasises the need to minimise the interference with the normal order of things by ensuring that any suspension lasts no longer than is "strictly necessary". It is not enough that the government would find it convenient to have more time, or that the period sought would be reasonable from an administrative point of view. The court must be satisfied that the period of suspension imposed is really needed, to avoid legal uncertainty. * Fourth, it added two criteria to this test, as per B v Latvia: (1) it must be shown that the party concerned has acted in good faith and (2) that immediate disapplication would cause "serious difficulties". = The EWCA held that all the aforementioned conditions were met in this case, but that the immediate disapplication of the Immigration Exemption would cause serious practical difficulties, at least in the short term because the Home Office still heavily relied on it. It considered different points made by the appellant and respondent in the case, and ultimately made "a declaration [that] (1) The immigration exemption in Paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 is incompatible with retained EU law in that it does not satisfy the requirements of Article 23(2) of the UK GDPR. (2) The declaration in paragraph 1 [was nonetheless] suspended until 31 January 2022 in order to provide a reasonable time for the Data Protection Act 2018 to be amended so as to remedy the incompatibility"