Elgizouli v Secretary of State for the Home Department

A competent authority transferring personal data abroad for law-enforcement purposes must consciously and contemporaneously apply the structured requirements of Part 3 of the Data Protection Act 2018. This includes the strict necessity test and the statutory conditions concerning appropriate safeguards or special circumstances. Substantial or retrospective compliance is insufficient.

The common law does not presently impose an absolute rule prohibiting the provision of information to a foreign state whenever the information may facilitate a prosecution carrying the death penalty. Decisions which may imperil life are nevertheless subject to especially anxious scrutiny on ordinary public law grounds.

The Secretary of State supplied evidence gathered by United Kingdom police to United States authorities investigating the appellant’s son and another person for exceptionally serious terrorist offences. Some possible charges carried the death penalty. The assistance was supplied without the assurances against execution which the United Kingdom had initially requested and ordinarily sought.

The Divisional Court dismissed the appellant’s judicial review claim in [2019] EWHC 60 (Admin). It certified questions concerning whether the common law prohibited such assistance and whether the transfer of personal data was lawful under Part 3 of the Data Protection Act 2018.

The central issues were whether the common law prohibited facilitating a foreign capital prosecution by supplying evidence and whether the Secretary of State had complied with the statutory conditions governing international transfers of law-enforcement data.

1. Appeal allowed on the data-protection ground. The court unanimously held that the decision could not stand because the Secretary of State had failed to comply with Part 3 of the Data Protection Act 2018. The transfer involved processing personal data for law-enforcement purposes, but the Secretary of State gave no conscious and contemporaneous consideration to the statutory framework. Substantial compliance was insufficient where the legislation required a direct assessment by the controller.

2. Section 73 establishes a structured decision-making framework. Condition 1 required the controller to decide whether the transfer was strictly necessary for a law-enforcement purpose. Condition 2 required the transfer to be based on an adequacy decision, appropriate safeguards or special circumstances. The required statutory assessment and documentation did not occur.

3. Per Lord Carnwath, the transfer was not based on appropriate safeguards. Recital (71) of the Law Enforcement Directive was a legitimate interpretative aid and contemplated safeguards ensuring that transferred data would not be used to request, impose or execute a death penalty. No such safeguard existed. Nor could the transfer be justified retrospectively by special circumstances: the contemporaneous decision reflected political expediency rather than an assessment that particular personal data were strictly necessary for a qualifying purpose.

4. The common-law ground was dismissed by the majority. Lord Reed, Lady Black and Lord Lloyd-Jones agreed with Lord Carnwath; Lord Hodge reached the same conclusion. The proposed absolute rule against supplying information which might facilitate a foreign capital prosecution was not an incremental development from an established common-law principle. Existing law prohibited certain removals to face capital punishment and required anxious scrutiny of decisions affecting life, but it did not establish a general non-facilitation rule applying to information transfers. Parliament had also enacted detailed legislation governing such transfers.

5. Lord Kerr dissented on that ground. He would have recognised a common-law principle prohibiting the state from facilitating a foreign trial carrying a risk of execution, subject to urgent necessity to save lives or protect national security. He nevertheless agreed that the data-protection ground independently made the decision unlawful.

6. Lord Reed observed that the sanctity of life may require especially intense rationality review. Possible concerns about the Secretary of State’s reasoning were not decided because they had not been pleaded and the Secretary of State had not had an opportunity to answer them.

1. United Kingdom Supreme Court: The appeal was allowed because the Secretary of State had not complied with Part 3 of the Data Protection Act 2018. The common-law ground was dismissed by the majority.

2. High Court, Divisional Court: In [2019] EWHC 60 (Admin), the court dismissed the judicial review claim on the merits but certified two questions of law of public importance.