The 3Million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

A statutory derogation from UK GDPR rights must contain the required safeguards in legislation. A policy document cannot supply those safeguards if the legislation merely requires it to exist or be considered. The legislative materials must also explain the risks to data-subject rights and freedoms, including relevant Convention and refugee-law rights. Parliament must be able to scrutinise the safeguards before approving the regulations. Legislation may retain operational flexibility if it defines the limitation with sufficient precision. A declaration of incompatibility may be suspended only exceptionally and for no longer than strictly necessary.

The claimants challenged the second version of an immigration exemption from rights conferred by the UK GDPR. The exemption was introduced by the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 and restricted specified information, access, erasure, restriction and objection rights where their exercise was likely to prejudice effective immigration control.

Saini J allowed the judicial review claim in part and declared the exemption unlawful, suspending the declaration for three months: [2023] EWHC 713 (Admin); [2023] 1 WLR 3011. The Secretary of State appealed. The central questions were whether the safeguards required by Article 23(2)(d) had to appear in the regulations themselves, whether Article 23(2)(g) was satisfied, and what period of suspension was appropriate.

1. Appeal dismissed. The declaration that the Immigration Exemption was incompatible with Article 23 of the UK GDPR was upheld. Its effect was suspended for three months from the date of the Court of Appeal’s order, with liberty to apply on written notice if unexpected circumstances required an extension.
2. Article 23(2) requires specific provisions in the legislative measure itself, where relevant. The safeguards required by Article 23(2)(d), concerning abuse and unlawful access or transfer, were not supplied by the Immigration Exemption. The regulations required an immigration exemption policy document, but did not specify the safeguards which that document had to contain. The document could be changed by the Secretary of State without parliamentary approval. That scheme therefore failed to provide safeguards with legislative force.
3. The duty to have regard to the policy document did not cure the defect. The strength of that public-law duty was immaterial because the contents of the document were not relied on as filling the legislative gap. The same conclusion followed regardless of where the document was published.
4. The exemption also failed Article 23(2)(g). An Explanatory Memorandum could in principle identify the risks to data-subject rights and freedoms, but the relevant assessment was contained only in an unpublished Rationale and Reasoning Note. The material before Parliament also failed adequately to address rights beyond those in the UK GDPR, including potentially relevant rights under the ECHR, the 1951 Refugee Convention, and the vulnerability of the data subject.
5. The court did not decide whether the phrase likely to prejudice itself necessarily expresses a balancing exercise. The appeal could be determined on the independent defects under Article 23(2)(d) and (g).
6. The phrase effective immigration control was sufficiently clear in context, and the exemption was limited by the prejudice-based test. No additional express review period was required for stored data because Article 5(1)(e) continued to apply and a data subject could make a fresh Article 15 request.
7. Suspension of the declaration was exceptional and had to last no longer than strictly necessary. Given that the exemption had twice been held unlawful and the government had long known of the issue, three months was sufficient.

• Court of Appeal (Civil Division): The second Immigration Exemption was held incompatible with Article 23 of the UK GDPR. The appeal from the High Court was dismissed, and the declaration was suspended for three months from the order date: [2023] EWCA Civ 1474.
• High Court of Justice, King’s Bench Division, Administrative Court: Saini J allowed the judicial review claim in part, declared the exemption unlawful and suspended the declaration for three months: [2023] EWHC 713 (Admin); [2023] 1 WLR 3011.