The Open Rights Group and the3million, as the claimants – Court Ruling (United Kingdom, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The UK Court of Appeal reviewed a case about the Immigration Exemption in the Data Protection Act 2018. The court found that the exemption, which limits certain GDPR rights for immigration control, was not affected by Brexit. This decision is important for organizations dealing with immigration data in the UK.
What happened
The Court of Appeal examined whether the Immigration Exemption in the Data Protection Act 2018 was compatible with GDPR requirements.
Who was affected
The case affected individuals whose data might be processed under the Immigration Exemption for immigration control purposes.
What the authority found
The court ruled that the UK's exit from the EU did not impact the applicability of the Immigration Exemption under the Data Protection Act 2018.
Why this matters
This ruling clarifies that certain GDPR rights can be limited for immigration control in the UK, even after Brexit. Organizations handling immigration data should be aware of how exemptions might apply to their data processing activities.
GDPR Articles Cited
National Law Articles
On appeal, the Court of Appeal (the “Court”) examined the decision of the High Court of Justice, Queen Bench Division, concerning the validity of the so-called Immigration Exemption, contained in the Data Protection Act 2018 ("DPA 2018"). The case concerned a judicial review claim brought by two organizations (a digital rights organization, 'The Open Rights Group' and a grass-roots organization 'the3million') against the Secretaries of State for the Home Department and Digital, Culture, Media and Sport. The claimants sought a declaration that the Immigration Exemption was unlawful, on grounds that it was incompatible with the General Data Protection Regulation ("GDPR") and the Charter of Fundamental Rights of the European Union ("EU"). In its decision, the Court focused on the former claim, and found that it was unnecessary to address the latter. As a preliminary point, the Court examined whether the withdrawal of the United Kingdom (“UK”) from the EU affected the claim. Further, the Court examined whether the Immigration Exemption contained in DPA 2018 complied with the legal requirements as prescribed by Article 23 GDPR. In essence, the Immigration Exemption excluded the application of certain GDPR rights and principles (including transparency requirements, right to erasure, right to restriction of processing, right to objections to processing, and so forth) in the case of activities for the maintaining of effective immigration control. In that sense, the Court especially examined the claim advanced by the claimants that the High Court of Justice was wrong to approach the case based on the jurisprudence of the European Court of Human Rights (“ECHR”). On the preliminary point, the Court found that the UK's withdrawal from the EU has not materially affected the case. The reason is that the EU (Withdrawal) Act 2018 provides for certain aspects of EU law to remain in force, as part of English law, notwithstanding withdrawal. The GDPR falls into this category of t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for The Open Rights Group and the3million, as the claimants in UK
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. The Open Rights Group and the3million, as the claimants - United Kingdom (2021). Retrieved from cookiefines.eu
Last updated: