The Open Rights Group & Anor, R (On the Application Of) v The Secretary of State for the Home Department & Anor (Rev1)

A restriction of rights under the General Data Protection Regulation is valid only if effected by a legally binding legislative measure satisfying article 23. Article 23(2) is a condition precedent, not merely an advisory checklist. The measure must contain specific, precise and reasonably foreseeable provisions addressing each listed matter relevant to the derogation.

General requirements of necessity and proportionality, safeguards elsewhere in the legal framework, and non-binding regulatory guidance do not satisfy that requirement. Accordingly, a broadly framed immigration exemption which contains no article 23(2) safeguards, and is unsupported by another qualifying legislative measure, is an unauthorised and unlawful derogation from fundamental data-protection rights.

Paragraph 4 of Schedule 2 to the Data Protection Act 2018 disapplied specified data-protection rights where their application would be likely to prejudice effective immigration control. Two organisations brought judicial review proceedings contending that this Immigration Exemption was incompatible with article 23 of the GDPR and with the Charter of Fundamental Rights.

Supperstone J dismissed the claim in [2019] EWHC 2562 (Admin). He held that the exemption pursued an important public interest, was capable of proportionate application and was supported by sufficient safeguards in the wider legal framework. On appeal, the central issue was whether article 23(2) required the legislative measure itself, or another legally binding measure tailored to the derogation, to contain specific provisions concerning the listed safeguards.

1. Appeal allowed. Article 23(2) of the General Data Protection Regulation particularises the requirements of article 23(1). Compliance with it is a condition precedent to the validity of a legislative measure restricting GDPR rights. Such a measure must contain specific provisions concerning every listed matter relevant to whether the restriction respects the essence of the right and is necessary and proportionate.

2. The required measure must be legally binding, tailored to the derogation, precise and capable of producing a reasonably foreseeable outcome. Article 23(2) is not merely an aide-memoire identifying matters that the state may consider. General principles of human-rights or administrative law, and safeguards found elsewhere in the GDPR, cannot substitute for the specific provisions demanded by article 23(2).

3. The CJEU jurisprudence supported that construction. It required derogations from fundamental data-protection rights to be strictly necessary and required appropriate safeguards to be built into legally binding legislation. It afforded no support for applying a less exacting standard merely because legislation permits, rather than itself effects, interference. The court nevertheless decided the appeal on the narrower ground arising from article 23(2), leaving the other disputed issues unresolved.

4. Paragraph 4 of Schedule 2 to the Data Protection Act 2018 contained no specific provision about any matter listed in article 23(2). Nor was there a separate qualifying legislative measure. Draft Home Office guidance did not qualify, and the Information Commissioner’s guidance lacked legal force. Its possible relevance to public-law decision-makers was insufficient, particularly because the exemption also applied to private persons and bodies.

5. The Immigration Exemption was therefore an unauthorised derogation from fundamental GDPR rights and was unlawful. The court deferred determination of the appropriate relief. Further submissions were required because the omission was potentially remediable by amending or supplementing the legislation and domestic courts might possess a limited power temporarily to suspend the disapplying effect of EU law.

1. Court of Appeal (Civil Division): Allowed the appeal in [2021] EWCA Civ 800, holding that the Immigration Exemption failed to comply with article 23(2) of the GDPR. The question of relief was deferred for further submissions.
2. High Court, Administrative Court: Supperstone J dismissed the judicial review claim in [2019] EWHC 2562 (Admin). He held that the exemption pursued an important public interest, was capable of lawful and proportionate operation, and was supported by adequate safeguards.