the3million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

A restriction of UK GDPR rights under Article 23 must be established by legislation which is clear, precise, legally binding, accessible and foreseeable. The legislation must itself contain the relevant substantive and procedural safeguards. A policy document cannot supply safeguards which the legislation omits, and a duty merely to have regard to such a document is insufficient. The legislation must also require a case-specific proportionality balance between the prejudice to the protected public interest and the data subject’s rights. A prejudice-based restriction does not require additional storage limits where it operates only while the prejudice test is met. The immigration exemption was unlawful because it omitted a legislative balancing requirement and safeguards concerning abuse, unlawful access or transfer, and risks to data subjects’ rights and freedoms.

The claimants challenged the second statutory version of the immigration exemption in section 4 of Schedule 2 to the Data Protection Act 2018, as amended by the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022. The exemption restricted specified UK GDPR rights where their exercise would be likely to prejudice effective immigration control or the investigation or detection of activities undermining it.

The first version had been held unlawful by the Court of Appeal in JR1, [2021] EWCA Civ 800, because it lacked a legislative measure containing the specific provisions required by Article 23(2). The issue was whether the amended legislation, including the requirement for an immigration exemption policy document, cured those defects.

1. Article 23 framework. A lawful restriction must be made by legislation, here regulations, and must be clear and precise, legally binding in domestic law, accessible and foreseeable. It must contain the relevant substantive and procedural conditions and safeguards. These Rule of Law requirements are conditions precedent and must be assessed before, although holistically alongside, necessity and proportionality (paras [36]-[43]).
2. Policy document. The immigration exemption policy document was not legislation. It was a changeable government policy subject only to a duty to have regard. The Regulations prescribed none of its substantive safeguards and did not give it binding force. Article 23(2) safeguards therefore could not lawfully be outsourced to it. Safeguards had to appear in legislation or in a code endorsed by Parliament and having statutory force (paras [45]-[46], [57], [64]-[65], [75]).
3. Individual complaints. “Effective immigration control” was sufficiently clear, and the legislation adequately identified the purposes and categories of processing. The scope of the exemption and the identity of the controller were also sufficiently specified. The phrase “would be likely to prejudice” required no further definition, but the legislation had to require an express balancing exercise between the prejudice and the data subject’s countervailing rights. The policy document could not supply that missing requirement (paras [47]-[60]).
4. Article 23(2)(d) was not satisfied because the Regulations did not prescribe the content of safeguards against abuse or unlawful access or transfer. Article 23(2)(f) did not require additional storage provisions: the exemption could operate only while the prejudice test was satisfied and could not place whole classes of data permanently beyond ordinary data protection rights (paras [61]-[68]).
5. Article 23(2)(g) was not satisfied. The Regulations contained no provision addressing risks to data subjects’ rights and freedoms, and the Explanatory Memorandum wrongly stated that nothing further was required. The court indicated that an express statutory direction to consider matters including relevant Convention and Refugee Convention rights and vulnerability would be capable of addressing the requirement, without undertaking the drafting exercise itself (paras [69]-[74]).
6. Grounds 1 and 2 succeeded. Declaratory orders were made that the immigration exemption was unlawful, but suspended for a short period to allow compliant legislation to be introduced (paras [75]-[76]).

The claim was a first-instance judicial review. The judgment described earlier Court of Appeal proceedings concerning the original exemption, including [2021] EWCA Civ 800 and [2021] EWCA Civ 1573, but those decisions formed part of the same litigation.