The Open Rights Group v The Secretary of State for the Home Department
| Jurisdiction | England & Wales |
| Judge | Lord Justice Singh,Lord Justice Warby,Lord Justice Underhill |
| Judgment Date | 26 May 2021 |
| Neutral Citation | [2021] EWCA Civ 800 |
| Date | 26 May 2021 |
| Docket Number | Appeal No: C1/2019/2726/QBACF |
| Court | Court of Appeal (Civil Division) |
The Queen on the application of
and
[2021] EWCA Civ 800
Lord Justice Underhill
(Vice-President of the Court of Appeal (Civil Division))
Lord Justice Singh
and
Lord Justice Warby
Appeal No: C1/2019/2726/QBACF
IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT
Mr Justice Supperstone
Royal Courts of Justice
Strand, London, WC2A 2LL
Ben Jaffey QC and Julianne Kerr Morrison (instructed by Leigh Day) for the Appellants
Sir James Eadie QC and Tristan Jones (instructed by the Treasury Solicitor) for the Respondents
The First Intervener was not represented
Christopher Knight (instructed by ICO) for the Second Intervener
Hearing dates: 24–25 February 2021
Approved Judgment
Introduction
This appeal is concerned with the lawfulness of statutory restrictions on data protection rights, in the context of immigration. By paragraph 4 of Schedule 2 to the Data Protection Act 2018 (“ DPA 2018”) Parliament enacted “the Immigration Exemption”. This disapplies some data protection rights where their application would be likely to prejudice immigration control.
The first appellant is a digital rights organisation that seeks to promote and uphold privacy and data protection rights. The second appellant is a grassroots organisation of EU citizens resident in the UK. On 29 August 2018, the appellants brought a judicial review claim against the Secretaries of State for the Home Department and Digital, Culture, Media and Sport, seeking a declaration that the Immigration Exemption was unlawful and an order disapplying it. The main grounds of challenge were that the Immigration Exemption was incompatible with the General Data Protection Regulation (“GDPR”) and/or with the Charter of Fundamental Rights of the European Union of 7 December 2000 (“the Charter”); accordingly, by virtue of the principle of supremacy of EU law, the Exemption could not stand. The respondents denied both these contentions.
The claim was heard by Supperstone J and dismissed by him for reasons set out in his judgment of 3 October 2019, [2019] EWHC 2562 (Admin). Permission to appeal was granted by my Lord, Singh LJ, on 14 November 2019.
The main issue in the appeal is whether the Immigration Exemption is non-compliant with Article 23 of the GDPR, the provision that authorises an exemption of this kind. For the reasons and to the extent set out below, I have concluded that it is, and that the appeal should therefore be allowed. This makes it unnecessary to address the appellants' additional contention that the Immigration Exemption is incompatible with Articles 7, 8 and 52 of the Charter (privacy, data protection and scope of guaranteed rights).
The Legal Framework
The GDPR
The GDPR (Regulation (EU) 2016/679) is EU legislation that is directly applicable in all EU Member States. It entered into force on 24 May 2016, and applied with effect from 25 May 2018. The UK is no longer a Member State, but Parliament has decided to keep substantially the same regime in place: see [12–13] below.
The GDPR enacts a number of data protection rights and obligations that are now familiar in general terms, as they were contained in the predecessor legislation, the Data Protection Directive 95/46/EC (“the Directive”) and given effect in the UK via the Data Protection Act 1998 (“ DPA 1998”). The GDPR also adds some new rights that were not expressly included in the Directive or DPA 1998, including the right to erasure or “right to be forgotten”.
The provisions that are relevant for present purposes are contained in Articles 5, 13–15, 17 and 21. Article 5 is contained in Chapter II (Principles). It sets out the six data protection principles, known for short as (a) lawfulness, fairness and transparency; (b) purpose limitation; (c) data minimisation; (d) accuracy; (e) storage limitation; and (f) integrity and confidentiality. The other relevant Articles are contained in Chapter III (Rights). Articles 13 and 14 prescribe the information to be provided to a data subject when collecting personal data that relates to them. Article 15 confers the right of access by the data subject, who is entitled to obtain confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and certain specified information about the processing. It also contains provision for the data subject to be given information about safeguards for data transfers to third countries, that is to say, countries outside the EU. Article 17 confers the right to have the controller erase personal data in specified circumstances. By Article 18, data subjects are given the right to have the controller restrict processing in specified circumstances. Article 21 confers a qualified right for the data subject to object “on grounds relating to his or her particular situation”, to certain kinds of processing of personal data. These include processing, the lawful basis for which is that it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” (Article 6(1)).
The GDPR contains a number of express exceptions to the rights it confers. None of these is directly relevant. We are concerned with Article 23, which authorises Member States to enact further exceptions. Article 23 is headed “Restrictions” and provides, so far as material, as follows:
“1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
(a) …;
(b) …;
(c) public security;
(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;
(e) other important objectives of general public interest …, in particular an important economic or financial interest …., including monetary, budgetary and taxation matters, public health and social security;
(f) the protection of judicial independence and judicial proceedings;
(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
(i) the protection of the data subject or the rights and freedoms of others;
(j) the enforcement of civil law claims.
2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least where relevant as to:
(a) the purposes of the processing or categories of processing;
(b) the categories of personal data;
(c) the scope of the restrictions introduced;
(d) the safeguards to prevent abuse or unlawful access or transfer;
(e) the specification of the controller or categories of controllers;
(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;
(g) the risks to the rights and freedoms of data subjects; and
(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.”
The DPA 2018
The Immigration Exemption was enacted in purported compliance with Article 23. It came into effect, with the rest of the DPA 2018, on 23 May 2018. Paragraph 4 of Part 1 of Schedule 2 provides:
“(1) The GDPR provisions listed in sub-paragraph (2) do not apply to personal data processed for any of the following purposes—
(a) the maintenance of effective immigration control, or
(b) the investigation or detection of activities that would undermine the maintenance of effective immigration control,
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).
(2) The GDPR provisions referred to in sub-paragraph (1) are the following provisions of the GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the GDPR)—
(a) Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b) Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c) Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d) Article 17(1) and (2) (right to erasure);
(e) Article 18(1) (restriction of processing);
(f) Article 21(1) (objections to processing);
(g) Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).
(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding...
To continue reading
Request your trial
-
Walter Tzvi Soriano v Forensic News LLC
...of “the UKGDPR”. This is the effect of the Data Protection Act 2018 and SI 2019/419: see R (Open Rights Group) v Secretary of State [2021] EWCA Civ 800, [2021] 1 WLR 3611 [5], [12–13]. For ease of reference I shall refer simply to the 74 The original Particulars of Claim alleged that the ......
-
J.C. Bamford Excavators Ltd v Manitou UK Ltd
...law passed or made before” 31 December 2020: see section 5(2) of the European Union (Withdrawal) Act 2018 and R (Open Rights Group) v Secretary of State for the Home Department [2021] EWCA Civ 800, [2021] 1 WLR 3611, at [12]–[13] (Warby 58 It is common ground between the parties that the ......
-
The 3Million v Secretary of State for the Home Department
...3 The first attempt to introduce the Immigration Exemption was held by this Court (Underhill, Singh and Warby LJJ) to be unlawful: [2021] EWCA Civ 800; [2021] 1 WLR 3611. After a further hearing to consider remedies, the Court suspended the effect of its declaration until 31 January 2022,......
-
The King on the application of the 3 Million and Open Rights Group v Secretary of State for the Home Department
...Government's first attempt at fashioning a lawful exemption was unsuccessful: R (Open Rights Group and the 3million) v SSHD and SSDCMS [2021] EWCA Civ 800; [2021] 1 WLR 3611 (CA) (referred to as “JR1” below). The Court of Appeal held that the exemption was unlawful because there existed n......
-
UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions
...handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the UK 2018 Data Protection Act’s (“DPA 2018”) “immigration exemption” is unlawful. The immigration exemption, found in par......
-
European Commission Adopts Adequacy Decisions For The UK
...the GDPR in order to reflect the Court of Appeal's judgment in The Open Rights Group v The Secretary of State for the Home Department [2021] EWCA Civ 800 on the validity interpretation of certain restrictions of data protection rights in this area; the Commission will reassess the need for ......
-
Court Of Appeal Finds Immigration Exemption Under Data Protection Act 2018 Non-compliant With Requirements Of GDPR
...inviting further submissions in the light of his findings. (The Open Rights Group v The Secretary of State for the Home Department [2021] EWCA Civ 800 (26 May 2021) ' to read the judgment in full, click The content of this article is intended to provide a general guide to the subject matter......
-
European Commission Adopts UK Adequacy Decision
...judgment of the UK Court of Appeal in R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, which ruled that the immigration exemption in the DPA 2018 is unlawful. The Commission stated that it will reassess the need for this excl......
-
The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022
...of Open Rights Group and another) v Secretary of State for the Home Department and another (Liberty and another intervening) ([2021] EWCA Civ 800). The immigration exemption allows certain specific rights and obligations in the UK GDPR to be restricted to the extent that giving effect to th......