Johnson v Secretary of State for the Home Department

The Court of Appeal dismissed the appellant's challenge to the transfer and processing of his personal and sensitive data for the purposes of an out-of-country appeal. The court held that the processing was for the "establishment, exercise or defence of legal claims" so that the appellant could not effectively rely on the right to object under Article 21 GDPR; domestic restrictions in the Data Protection Act 2018 (schedule 2, paragraphs 5 and 14) lawfully limited that right. The court accepted the FTT's factual findings that erasure arrangements (destruction within seven days) and safeguards were reliable and proportionate and that, even if the transfer to the British High Commission in Jamaica amounted to a transfer to a third country, it was justified under Article 49(1)(e) GDPR as necessary for legal claims. The court also rejected the discrimination challenge and upheld the FTT's conclusion that the out-of-country hearing conducted by video-link was fair.

The appellant, a Jamaican national deported from the United Kingdom and certificated as having an out-of-country appeal only under section 94B of the Nationality, Immigration and Asylum Act 2002, objected to the transfer of his personal and sensitive data to the British High Commission in Kingston, Jamaica for a First-tier Tribunal hearing by video-link. He sought, as a remedy, leave to enter the United Kingdom so that his appeal could be heard in-country without the transfer. The First-tier Tribunal dismissed his objections and the human rights appeal (promulgated 14 August 2018). The Upper Tribunal dismissed his appeal from the FTT on 12 March 2019. He appealed to the Court of Appeal.

The Court of Appeal summarised the issues as: (i) whether the appellant could object to processing of his personal and sensitive data for the out-of-country appeal (Article 21 GDPR); (ii) whether erasure arrangements were sufficient (Article 17 GDPR); (iii) whether the appellant could object to transfer to Jamaica and whether Chapter V GDPR was engaged; (iv) whether the video-link out-of-country procedure was discriminatory; and (v) whether the appellant's human rights were infringed because the out-of-country appeal was not fair.

• On (i) the court held the proceedings were "the establishment, exercise or defence of legal claims" so Article 21 did not prevent processing; in addition domestic law (DPA 2018, schedule 2 paragraphs 5 and 14) provided a proportionate restriction that allowed disclosure and transfer where necessary for legal proceedings.
• On (ii) the court accepted the factual findings that data would be retained no longer than seven days and would be destroyed; there was no breach of the right to erasure in the circumstances.
• On (iii) the court observed there were arguments about whether data transferred to a diplomatic/consular mission is a transfer to a third country, but concluded that even if Chapter V GDPR applied the transfer was justified under Article 49(1)(e) as necessary for legal claims and proportionate.
• On (iv) the discrimination argument failed because the appellant, a third-country national, was not in an analogous position to EEA nationals and immigration controls legitimately differentiate on the basis of nationality.
• On (v) the court concluded the FTT had reasonably and lawfully found the out-of-country hearing by video-link to be fair and that there was no error of law in its assessment of the best interests of the child or in the substantive human rights conclusions.

The court emphasised that even if no transfer could lawfully be made without consent, adjourning to enable in-country attendance would not necessarily avoid processing and could be ineffective; the remedy of ordering return to the UK is not an automatic consequence. The appeal was dismissed.

The appeal was dismissed. The court held that processing and transfer of the appellant's personal and sensitive data for an out-of-country appeal were lawful and proportionate: the processing fell within the "establishment, exercise or defence of legal claims" so Article 21 GDPR did not permit the appellant to prevent processing; domestic restrictions in the Data Protection Act 2018 (schedule 2, paragraphs 5 and 14) lawfully limited the right to object; erasure safeguards were adequate; any transfer to Jamaica was justified under Article 49(1)(e) GDPR as necessary for legal claims; there was no impermissible discrimination; and the out-of-country video-link hearing was fair.

Appeal from Upper Tribunal (Immigration and Asylum Chamber) decision dated 12 March 2019 (appeal from First-tier Tribunal decision promulgated 14 August 2018 following a hearing on 17 July 2018). Upper Tribunal appeal No. HU/06110/2017. Court of Appeal judgment [2020] EWCA Civ 1032 dismissing the appeal.