Court of Appeal rules DPA exemption incompatible with GPDR

The Court of Appeal has shown that it will carefully examine exemptions to data subjects rights contained in the Data Protection Act 2018 ("DPA") and has reasserted the primacy of the GDPR (or UK GDPR) over other UK data protection legislation.  In The Open Rights Group & Anor, R (On the Application Of) v The Secretary of State for the Home Department & Anor [2021] EWCA Civ 800, the Court of Appeal held that the 'immigration exemption' in the DPA is unlawful and incompatible with the GDPR.

The claimants initially brought a judicial review claim in 2018, seeking a declaration that the 'immigration exemption' in the DPA is incompatible with the GDPR after the Home Office invoked it in 59% of the data subject access requests it received in the first year of the DPA's operation.  The High Court upheld the 'immigration exemption', finding that the exemption was compatible with the requirements of the GDPR.  The claimants appealed.

The Court of Appeal allowed the claimants' appeal on the basis that the 'immigration exemption' in paragraph 4 of Schedule 2 to the DPA does not comply with the criteria for exemptions to data subjects rights set out in Article 23 of the GDPR.  The Court of Appeal found that specific requirements for such exemptions set out in Article 23(2) should be satisfied by a binding legislative measure.

The decision

The GDPR gives individuals ("data subjects") a range of rights, including rights to information about how their personal data are processed, rights to access their personal data, and rights to have it corrected or erased, and places corresponding obligations on those controlling individuals' personal data.  However, Article 23 of the GDPR allows Member States to create exemptions to restrict these rights in certain circumstances (such as on grounds of national security).

Under Article 23(1) such exemptions must respect the "essence of the fundamental rights and freedoms" and be "necessary and proportionate... in a democratic society".  Alongside these broad requirements, Article 23(2) sets out a list of "specific provisions" that any legislative measure creating a restriction to data subjects' rights must contain.  For example, the legislative measure must contain the purpose of the processing, the relevant categories of personal data, the scope of the restriction introduced and details of the accompanying safeguards.

Considering whether these requirements were met by the 'immigration exemption' in the DPA, the Court of Appeal found that the exemption contained nothing about any of the matters listed in Article 23(2).  Nor were those matters covered in any separate piece of binding legislation.  Non-binding guidance containing such details but without the force of law was also found to be insufficient to satisfy the requirements of Article 23(2).  As a result, the Court of Appeal held that it was "clear" that the 'immigration exemption' did not comply with the GDPR.

Post-Brexit the GDPR continues to take precedence over UK domestic legislation, such as the DPA, because the GDPR has been incorporated into UK law as 'retained EU law' under the European Union (Withdrawal) Act 2018.  Such 'retained EU law' overrides contradictory legislation.  The GDPR has also been specifically been imported into domestic legislation as the UK GDPR.  Consequently, the 'immigration exemption' - despite its inclusion in primary legislation - is unlawful in the UK.

Comment

The decision in Open Rights Group indicates that the English courts will not hesitate to scrutinise carefully exemptions to the rights and obligations in the GDPR (or UK GDPR).  The government has not sought permission to appeal to the Supreme Court, but it remains to be seen whether the decision in Open Rights Group could lead to further challenges to DPA exemptions.    

The Court of Appeal has not yet determined what relief will be granted in the case, but made a point of emphasising that the omissions identified were capable of remedy by amendments to the 'immigration exemption'.  It is therefore possible that the decision will lead to amendment to this and other exemptions contained in Schedule 2 to the DPA.