Open Rights Group & Anor, R (On the Application Of) v Secretary of State for the Home Department & Anor

An abstract statutory exemption from data-protection rights is lawful where it is clear, foreseeable and capable of proportionate application in individual cases. The legislation need not itself codify every safeguard or require proof of strict necessity at the enactment stage where it creates a power that controllers may use only when justified by the circumstances. The requirements of necessity, proportionality and the statutory enforcement scheme may provide adequate protection against arbitrariness. An ab ante challenge fails where the provision is capable of operating compatibly with fundamental rights and there is no evidence of unjustified interference in all or almost all cases.

The claimants challenged paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018, which restricts specified rights under the GDPR where compliance would be likely to prejudice effective immigration control or the investigation or detection of activities undermining it.

They alleged incompatibility with Article 23 of the GDPR and Articles 7, 8 and 21 of the Charter. The discrimination ground was accepted to add nothing to the principal challenge. The court therefore considered whether the Immigration Exemption was sufficiently clear and safeguarded, whether its enactment required proof of strict necessity, and whether it was proportionate as an abstract legislative measure.

1. Claim dismissed. The Immigration Exemption was lawful and none of the grounds of challenge was made out.
2. The relevant question was whether legislation creating an exemption which may be relied upon by a controller in a particular case was accessible, foreseeable and sufficiently precise to protect against arbitrary interference. The exemption was comprehensible. The expressions relating to effective immigration control were readily understood.
3. The words “would be likely to prejudice” imposed a substantial threshold. The exemption could be used only to the extent that compliance with the listed GDPR provisions would be likely to prejudice the specified immigration-control purposes. Necessity and proportionality also applied when the exemption was used in an individual case.
4. The Data Protection Act 2018 had to be read with the GDPR. The proportionality requirement was therefore supplied by the wider statutory regime even though paragraph 4 did not restate it expressly. The Commissioner, tribunal and court enforcement mechanisms supplied additional safeguards.
5. There was no requirement to justify the enactment of the exemption by evidence establishing strict necessity. That higher standard applied where the legislation itself constituted or required an interference with individual rights. The Immigration Exemption instead made abstract provision for a power which might lawfully be exercised only where justified.
6. The exemption’s scope was sufficiently delineated. It was not unlawful merely because it could be relied upon by controllers outside government, including where data was obtained from third parties, since that was necessary to make the scheme effective.
7. The ab ante proportionality challenge failed. The evidence did not suggest that the exemption would operate so as to cause unjustified interference with Article 8 rights in all or almost all cases. Guidance might be influential, but additional statutory guidance was not required to make the legislation lawful.