The Open Rights Group and the3million, as the claimants – Court Ruling (United Kingdom, 2021)

On appeal, the Court of Appeal (the “Court”) examined the decision of the High Court of Justice, Queen Bench Division, concerning the validity of the so-called Immigration Exemption, contained in the Data Protection Act 2018 ("DPA 2018"). The case concerned a judicial review claim brought by two organizations (a digital rights organization, 'The Open Rights Group' and a grass-roots organization 'the3million') against the Secretaries of State for the Home Department and Digital, Culture, Media and Sport. The claimants sought a declaration that the Immigration Exemption was unlawful, on grounds that it was incompatible with the General Data Protection Regulation ("GDPR") and the Charter of Fundamental Rights of the European Union ("EU"). In its decision, the Court focused on the former claim, and found that it was unnecessary to address the latter. As a preliminary point, the Court examined whether the withdrawal of the United Kingdom (“UK”) from the EU affected the claim. Further, the Court examined whether the Immigration Exemption contained in DPA 2018 complied with the legal requirements as prescribed by Article 23 GDPR. In essence, the Immigration Exemption excluded the application of certain GDPR rights and principles (including transparency requirements, right to erasure, right to restriction of processing, right to objections to processing, and so forth) in the case of activities for the maintaining of effective immigration control. In that sense, the Court especially examined the claim advanced by the claimants that the High Court of Justice was wrong to approach the case based on the jurisprudence of the European Court of Human Rights (“ECHR”). On the preliminary point, the Court found that the UK's withdrawal from the EU has not materially affected the case. The reason is that the EU (Withdrawal) Act 2018 provides for certain aspects of EU law to remain in force, as part of English law, notwithstanding withdrawal. The GDPR falls into this category of the so-called “retained EU law”. The rule is that, in case of conflict between pre-Brexit domestic legislation (such as DPA 2018) and retained EU law (such as GDPR), the latter would take precedence in line with the principle of supremacy of EU law. Therefore, the validity of the Immigration Exemption could be examined under GDPR. On the main issue, the Court found the Immigration Exemption to be incompatible with Article 23 GDPR. According to the Court, Article 23 GDPR prescribes mandatory requirements, and any legislative measure containing a derogation from the fundamental rights conferred by the GDPR must comply with such mandatory requirements. Among other, any legislative measure must at least include specific provision about each of the eight matters listed in Article 23 GDPR (such as the purposes of the processing, the categories of personal data, the scope of the restrictions, the safeguards to prevent abuse, etc.). In other words, containing such a specific provision is a condition precedent for the validity of the legislative measure. If this requirement is complied with, the Court would go on to examine other requirements such as the necessity and proportionality of the measure. In the present case, the Immigration Exemption failed to list the specific provisions as required by Article 23 GDPR. In that sense, the Court did not accept that a non-binding code promulgated by a regulator (even if compliant with the GDPR) could substitute the legislative measure. The Court also examined the approach taken by the High Court of Justice, which relied on the jurisprudence of the ECHR and merely examined the legislative measure under the requirements of necessity and proportionality. The Court disagreed with this approach. It found that Article 23 should not be construed as merely requiring the state to provide a general legal framework that contains guarantees of necessity and proportionality, and other safeguards. The function of Article 23 GDPR is different to that of the ECHR, as it permits the state to restrict the very scope of the right. For this reason, Article 23 provides a mandatory checklist of thing “to do” and calls for specific provisions. The Court left the matter of remedy open, but stated that such omission is, in principle, capable of remedy by measures that amend or supplement the existing provision.