Court of Appeal Finds Exemption of UK Immigration in Data Protection Act Unlawful

In the recent case of R. (on the application of Open Rights Group) v Secretary of State for the Home Department [2021] EWCA Civ 800, the Court of Appeal ruled that the exemption which applies to immigration data in the Data Protection Act 2018 (DPA 2018) is unlawful, overturning a previous High Court decision in 2019. In this article, we will take a look at why the Court of Appeal decided that immigration data should not be exempt from the Data Protection Act and what will happen next as a result of the decision.

What Does The DPA 2018 State In Relation To Immigration Data?

Schedule 2 Part 1 Paragraph 4 of the DPA 2018 states, “The GDPR provisions listed in sub-paragraph (2) do not apply to personal data processed for any of the following purposes—

(a)the maintenance of effective immigration control, or

(b)the investigation or detection of activities that would undermine the maintenance of effective immigration control, to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).”

In this context, the GDPR refers to the General Data Protection Regulations, which originated from EU law. Paragraph 2, as referred to above, then lists the various aspects of the UK’s implementation of the GDPR which may be exempted in relation to immigration data; this includes:

• Article 13(1) to (3) (personal data collected from the data subject: information to be provided);
• (b)Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
• (c)Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
• (d)Article 17(1) and (2) (right to erasure);
• (e)Article 18(1) (restriction of processing);
• (f)Article 21(1) (objections to processing);
• (g)Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).

Why Was The Case Brought?

The case was brought by the digital campaign group Open Rights Group on the basis that the exemption for immigration data in the UK “is so-over broad as to be in breach of the express requirements governing derogations in Article 23(2) of the GDPR and the CJEU’s strict case law providing protection for data rights against attempts [to apply] generally worded derogations”. Article 23(2) is intended to provide guidance on when an exemption of this kind can be applied.

As Computer Weekly points out, this exemption (also referred to as a derogation) is the first of its type in 20 years in UK data protection law, and that it “not only affects EU nationals, but anyone who has dealings with any of the state bodies or companies involved in “immigration control”. This includes people seeking refuge in the UK or those affected by the Windrush scandal”.

A High Court decision in 2019 ruled that the exemption was lawful as it was within GDPR Article 23(1)(e) because it was a matter of “important public interest”.

An appeal against this decision was brought on the basis that the judge was wrong and that immigration data exemption is non-compliant with Article 23 of the GDPR.

What Did The Court Of Appeal Conclude?

The appeal was allowed on the basis that the Court of Appeal considered that exempting immigration data is indeed non-compliant with Article 23 of the GDPR, for the following reasons:

• The principle of EU law supremacy applies – this supremacy makes it clear that where the law of a Member State is not consistent with EU law, EU law prevails. While the UK has left the EU, parliament had decided to keep the Regulation in place, and hence the principle holds.
• The European Court of Justice and EU case law does not support such a derogation
• Evidence from the Information Commissioners Office (ICO) “supports the appellants’ position that the relevant test is one of strict necessity, and challenges the Judge’s conclusion on proportionality”. The ICO representative also stated that “without guidance carrying statutory force the Exemption is a disproportionate interference with fundamental rights”.

The challenge as the Court of Appeal sees it is that Article 23(2) of the GDPR lacks specific legislative provisions. This is the basis on which the Court of Appeal agreed with the appellants; “In the absence of any such measure, the Immigration Exemption is an unauthorised derogation from the fundamental rights conferred by the GDPR, and therefore incompatible with the Regulation. For that reason, it is unlawful”. Later the judgment states, “The Exemption itself contains nothing, specific or otherwise, about any of the matters listed in Article 23(2)”.

Responding to the decision, Sahdya Darr, immigration policy manager at the Open Rights Group, stated, “This is a momentous day. The Court of Appeal has recognised that the Immigration Exemption drives a huge hole through data protection law, allowing the government to restrict access to information that may be being used to deny people their rights”. He went on to say, “If the government holds information about you, it should only be in the most exceptional circumstances that it is denied to you, such as during a criminal investigation….The treatment of immigrants as criminals and suspects is simply wrong. The suffering of the Windrush generation shows that Home Office use of data is poor. The court has today found that proper safeguards should be put in place to help prevent future abuses and to ensure that people are treated fairly and lawfully”.

Final Words

This is not the end of the matter. In summing up, the judge stated, “I would defer a decision on relief, inviting further submissions on that issue in the light of these reasons”. We will update you on the final outcome in terms of the remedy and how this will shape the future of data protection when it comes to immigration. We can only hope that whatever does happen prevents the unlawful processing and disclosure of personal data held on those within the UK’s immigration system.