R (Open Rights Group and the3million) v Secretary of State for the Home Department and Secretary of State for Digital, Culture, Media and Sport

The Court of Appeal allowed the challenge to paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 (the "Immigration Exemption"). The principal legal issue was whether that exemption complied with Article 23 of the GDPR (now Article 23 of the UK GDPR), in particular the specific requirements set out in Article 23(2). The court held that Article 23(2) requires any legislative measure restricting data protection rights to contain specific, precise and legally binding provisions addressing the listed matters where relevant, and that no such legislative measure exists in relation to the Immigration Exemption.

The court concluded that the Exemption is therefore an unlawful derogation from GDPR rights because it lacks the specific provisions and binding safeguards required by Article 23(2). The court relied on the CJEU jurisprudence (including Digital Rights Ireland, Tele2, Opinion 1/15, Privacy International and La Quadrature) which demands strict necessity and clear, precise, legally binding safeguards for derogations. The appeal was allowed and the question of appropriate relief was deferred for further submissions.

This was an appeal from the decision of Supperstone J ([2019] EWHC 2562 (Admin)) dismissing a judicial review claim brought by the Open Rights Group and the3million. The claim sought a declaration that the Immigration Exemption in paragraph 4(1) of Part 1 of Schedule 2 to the Data Protection Act 2018 was unlawful and should be disapplied, on the grounds that it was incompatible with the GDPR and the Charter of Fundamental Rights.

The appellants argued that the Exemption did not satisfy Article 23 of the GDPR because Article 23(2) mandates that any legislative measure restricting data protection rights must contain specific provisions regarding matters such as purposes of processing, categories of data, scope of restrictions and safeguards to prevent abuse. They relied on CJEU authorities stressing strict necessity, legal certainty and the need for clear and precise safeguards (Digital Rights Ireland, Tele2, Opinion 1/15, Privacy International and La Quadrature).

The respondents contended that the Exemption was a permissible, "permissive" measure and that the applicable tests of legality, necessity and proportionality could be satisfied by general legal principles, existing GDPR provisions, the DPA 2018 as a whole, the Human Rights Act 1998 and non-binding guidance, without the need for a tailored legislative measure containing the Article 23(2) specifics.

The Court of Appeal examined the text of Article 23 and the CJEU jurisprudence and concluded that Article 23(2) operates as a mandatory, particularising requirement: a legislative measure authorised under Article 23(1) must contain specific, legally binding provisions on the matters listed in Article 23(2), insofar as they are relevant. The Immigration Exemption contains no such specific provisions; there is no separate legally binding legislative measure addressing those topics; and non-binding guidance (including ICO guidance and internal draft guidance) is insufficient. For those reasons the Exemption is incompatible with Article 23 and unlawful. The court allowed the appeal and deferred detailed consideration of remedy to permit further submissions.

• Nature of claim: judicial review seeking declaration that the Immigration Exemption is incompatible with the GDPR and Charter and should be disapplied.
• Issues framed by the court: interpretation of Article 23 GDPR, the role and content of Article 23(2), whether the Exemption is "in accordance with the law" and proportionate, and whether non-binding guidance or general legal safeguards suffice.
• Court’s reasoning: Article 23(2) requires specific, legally binding provisions in any legislative measure restricting data protection rights; CJEU case-law requires strict necessity and clear, precise safeguards; the Immigration Exemption contains no such measure and is therefore an unlawful derogation; remedy deferred for further submissions.

Appeal allowed. The Court held that Article 23(2) GDPR requires any legislative measure restricting the rights set out in Articles 12–22 to contain specific, precise and legally enforceable provisions addressing the matters listed in Article 23(2) where relevant. Paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 contains no such specific legislative provisions and there is no separate legally binding measure fulfilling Article 23(2). For that reason the Immigration Exemption is incompatible with Article 23 and unlawful. The court deferred the question of appropriate relief for further argument.

Appeal from the High Court (Administrative Court, Supperstone J), [2019] EWHC 2562 (Admin). Permission to appeal granted by Singh LJ on 14 November 2019. This Court (EWCA Civil) delivered judgment allowing the appeal on 26 May 2021: [2021] EWCA Civ 800.