The Court of Appeal’s conclusion that the ‘Immigration Exemption’ in Schedule 2 to the DPA 2018 is not compliant with the GDPR creates two data protection headaches for Government.
First, the Court’s method of determining the illegality of the immigration exemption (i.e. that the safeguards in Article 23(2) of the GDPR were missing from the UK’s DPA2018), applies to ALL exemptions in Schedules 2 to 5. So does this mean ALL exemptions in the DPA2018 are equally unlawful?
Second, if ALL the exemptions are invalid, does the Court of Appeal judgment show that the UK’s implementation of the UK_GDPR does not offer an adequate level of protection for data subjects because important safeguards for data subjects (specified in Article 23(2)) are missing?
Both questions have already been raised by those “Europeans” as theoretical questions; the Court of Appeal has just provided an explosive answer.
Adequacy at risk
As stated above, the European Data Protection Board (EDPB), in its critique of the UK’s DP regime, has already raised the immigration exemption as an adequacy issue but only with respect to the Immigration Exemption (and not generally with respect to all exemptions as with the Court of Appeal).
In the EDPB “Opinion” of the UK_GDPR (see references), it invited the European Commission:
- “…..to verify the state of play of the (Court of Appeal) proceedings, to verify whether it is confirmed or reviewed by the appeal judgment, to take any update in this regard into account, and to specify it in the adequacy decision. The EDPB also calls on the European Commission to provide further information on the necessity and proportionality of the immigration exemption”….
- “….to further explore whether additional safeguards exist in the UK legal framework or could be envisaged, for instance through legally binding instruments that would complement the immigration exemption enhancing its foreseeability by and the safeguards for data subjects, also allowing for a better and prompt assessment and monitoring of the necessity and proportionality requirements”. (Detail under section 3.1.1 of the EDPB Opinion).
This EDPB “invitation” to the Commission to re-write parts of its adequacy decision with respect to the immigration exemption, now presumbably extends to include ALL exemptions in the DPA2018 (including some dodgy ones such as the confidential references exemption).
The European Parliament has also made comments in this area. In its resolution into the adequacy of the protection of personal data in the UK, published last week, there is a specific section devoted to “Data processing for immigration control”. This states that the European Parliament:
“…Notes that this exemption now applies to EU citizens who reside or plan to reside in the UK; is strongly concerned that the exemption removes key opportunities for accountability and remedies, and underlines that this is not an adequate level of protection…..and calls on the Commission to seek the removal of the immigration exemption, or to ensure that it is reformed so that the exemption and its use provide sufficient safeguards for data subjects and do not breach the standards expected of a third country”
As the above comment now applies to ALL exemptions, the presumption is that the European Parliament is also expecting a Commission re-write of parts of the adequacy determination.
The Immigration Exemption itself
I have criticised the immigration exemption in previous blogs on proportionality grounds and the lack of safeguards. To my mind, the inclusion of the exemption on the grounds that it was “of important public interest” (as required by Article 23(1)(e)) is redolent of the debates surrounding Data Protection Bill 1983 where a similar exemption was heavily criticised as being overtly racist (see blog references). The criticism at the time was so damning that it helps to explain why the immigration exemption was omitted from the DPA1984 and DPA1998.
In allowing the appeal with respect to the DPA2018, Warby LJ made the following points (from para 50 of the judgment):
- The broad legal provisions in Article 23(1) (such as those that require a measure to be necessary and proportionate in pursuit of a legitimate aim) “are insufficient to protect the individual against the risk of unlawful abrogation of fundamental right”.
- “The legal framework will not provide the citizen with sufficient guarantees that any derogation will be strictly necessary and proportionate to the aim in view, unless the legislature has taken the time to direct its attention to the specific impacts which the derogation would have, to consider whether any tailored provisions are required and, if so, to lay them down with precision”.
- “This approach (i.e.directing attention to specific impacts) will tend to make the scope and operation of a derogation more transparent, improve the quality of decision-making, and facilitate review of its proportionality…”
- “On my reading of Article 23 as a whole, it seems clear that the Immigration Exception is non-compliant. The Exemption itself contains nothing, specific or otherwise, about any of the matters listed in Article 23(2). Even assuming, without deciding, that it is permissible for the “specific provisions” required by Article 23(2) to be contained in some separate legislative measure, there is no such measure”.
I should add that Warby LJ also hinted at how Government could resolve the issue on Appeal.
- “…the respondents’ stance is that it is enough for individual decisions to comply with the general requirements of the GDPR itself, extraneous legislation such as the Human Rights Act, and other measures of legal control. That stance, in my judgment, is legally wrong”.(my emphasis)
- “…It may be open to the legislature to conclude that one or more of the matters listed in Article 23(2) is not relevant to this particular exemption. It may even be entitled to conclude that although a particular matter is relevant it is unnecessary to set limits any narrower than those contained in the GDPR itself” (see next para for examples).
Remember, Warby LJ’s “legally wrong” comment apply to ALL exemptions, so Government could be forced to appeal to the Supreme Court and argue that the Court of Appeal is in error to insist that the provisions of Article 23(2) must appear in the DPA2018 legislation. For example, one could argue that the requirement in A.23(2) is already specified explicitly as shown below:
(a) the purposes of the processing or categories of processing; (Comment: the Government could argue that the immigration exemption is specified in terms of the exemption’s purpose(s) – e.g. the purpose of immigration control).
(b) the categories of personal data; (Comment; the Government could argue that as the exemption does not exclude the application of Article 6(1)(e) or Article 5(1)(c) so the categories of personal data are specified in the UK_GDPR and restricted to those “relevant and necessary in relation to the purpose of the processing”).
(c) the scope of the restrictions introduced; (Comment: the Government could argue that the exemption is specified in the DPA2018 and is limited to cases where the rights would “prejudice” the purpose of the processing).
Now I could continue through the rest of A.23(2) using the same approach but I think you get the idea; all paragraphs can be justified and specified explicitly in terms of existing UK_GDPR provisions.
Concluding comment
It appears the Government has three choices: appeal to the Supreme Court (which takes time) or ask the European Commission for time extension to sort out the data protection adequacy mess (e.g. the Government commits to amending the DPA2018 in the current Parliamentary session to include the missing safeguards).
Alternatively, the UK in the guise of the Home Office (Prop. Ms Priti Patel) could decide to state that it is taking back control of its “data protection laws and borders”- in which case, there is no change to UK law and a European Commission adequacy determination becomes a pipe-dream.
As there is little time to decide, data protection has come even more exciting!
Upcoming Data Protection Course
Because of Indian variant and the consequent COVID lockdown uncertainty, the following course can be attended in person or via Zoom or a mixture (it's up to you)
Data Protection Practitioner: London, Starts July 13 (6 days)
Full details on www.amberhawk.com/StandardDP.asp or by emailing i[email protected]
References
Previous blogs on immigration exemption in the DPA2018
- “DP Bill’s new immigration exemption can put EU citizens seeking a right to remain at considerable disadvantage”: https://amberhawk.typepad.com/amberhawk/2017/10/dp-bills-new-immigration-exemption-can-put-eu-citizens-seeking-a-right-to-remain-at-considerable-dis.html
- “Judicial review: how did the Government decide that the immigration exemption was in “the public interest”? https://amberhawk.typepad.com/amberhawk/2019/06/judicial-review-how-did-the-government-decide-that-the-immigration-exemption-was-in-the-general-publ.html
Immigration case Judgement in R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800,
Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom – on the EDPB website
European Parliament resolution of 21 May 2021 on the adequate protection of personal data by the United Kingdom (2021/2594(RSP)) - google the reference.
Comments