4
(1)
The relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State for any of the following purposes—
(a)
the maintenance of effective immigration control, or
(b)
the investigation or detection of activities that would undermine the maintenance of effective immigration control,
to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in paragraphs (a) and (b).
(1A)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1B)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1C)
Paragraphs 4A and 4B make provision about
... safeguards in connection with the exemption in sub-paragraph (1)
.
(2) In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions” are the following provisions of the UK GDPR (the rights and obligations in which may be restricted by virtue of Article 23(1) of the UK GDPR )—
(a)
Article 13(1) to (3) (personal data collected from data subject: information to be provided);
(b)
Article 14(1) to (4) (personal data collected other than from data subject: information to be provided);
(c)
Article 15(1) to (3) (confirmation of processing, access to data and safeguards for third country transfers);
(d)
Article 17(1) and (2) (right to erasure);
(e)
Article 18(1) (restriction of processing);
(f)
Article 21(1) (objections to processing);
(g)
Article 5 (general principles) so far as its provisions correspond to the rights and obligations provided for in the provisions mentioned in sub-paragraphs (a) to (f).
(That is, the listed GDPR provisions other than Article 16 (right to rectification), Article 19 (notification obligation regarding rectification or erasure of personal data or restriction of processing) and Article 20(1) and (2) (right to data portability) and, subject to sub-paragraph (2)(g) of this paragraph, the provisions of Article 5 listed in paragraph 1(b).)
(3)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Cases considering Schedule 2, paragraph 4 5
[2023] EWCA Civ 1474 · 11 December 2023Limits
Paragraph 4 was the Immigration Exemption. The court held that its reliance on an immigration exemption policy document did not place the required safeguards in the legislation itself and that its risks assessment was inadequate (see paras [30]-[31]; [58]-[78]).
Paragraph 4(1) limited the exemption to processing by the Secretary of State for maintaining effective immigration control or investigating or detecting activities undermining it, where application of the rights would likely prejudice those purposes. The court accepted that effective immigration control was sufficiently clear (see paras [30]-[31]; [85]-[86]).
The provision identified maintenance of effective immigration control as an immigration purpose. The court treated that purpose as sufficiently clear in context and did not require a narrower definition (see paras [85]-[86]).
The provision identified investigation or detection of activities undermining effective immigration control as an immigration purpose. It formed part of the sufficiently clear statutory description of the exemption’s purpose (see paras [85]-[86]).
Paragraph 4(1A) made the exemption conditional on the Secretary of State having an immigration exemption policy document in place. The court treated that condition as insufficient to provide the legislative safeguards required by Article 23(2)(d) (see paras [30]; [60]-[63]).
Paragraph 4(1B) required the policy document to explain policies and processes for assessing prejudice and preventing abuse or unlawful access or transfer. The court held that this did not prescribe the safeguards themselves in legislation (see paras [30]; [62]-[63]).
Paragraph 4(1C) referred to additional safeguards in paragraphs 4A and 4B. Those provisions did not cure the failure to specify safeguards against abuse and unlawful access or transfer within the regulations themselves (see paras [30]; [62]-[72]).
Paragraph 4(2) identified the UK GDPR provisions capable of restriction. The court treated the statutory scope as sufficiently identified for the live issues, while finding independent failures under Article 23(2)(d) and (g) (see paras [30]; [58]; [82]-[92]).
[2021] EWCA Civ 800 · 26 May 2021Disapplies
The court disapplied the Immigration Exemption’s claim to validity because it contained none of the specific provisions required by article 23(2) and was unsupported by another qualifying legislative measure (see paras [29]; [53-54]).
The subsection’s prejudice-based restriction for immigration-control processing did not supply the tailored safeguards demanded by article 23(2) (see paras [9]; [53-54]).
The subsection identified the GDPR rights capable of restriction but did not contain the specific safeguards required by article 23(2) (see paras [9]; [53-54]).
The controller-to-controller conditions formed part of the Immigration Exemption but did not remedy its omission of article 23(2) safeguards (see paras [9]; [53-54]).
The extension of exemptions to a transferring controller formed part of the unlawful scheme and did not supply the specific safeguards required by article 23(2) (see paras [9]; [53-54]).
[2023] EWHC 713 (Admin) · 29 March 2023Limits
Creates the immigration exemption and restricts specified UK GDPR rights where their exercise would be likely to prejudice effective immigration control or related investigation and detection. (see paras [17], [21]-[22], [50], [52]-[57])
Uses the likely-to-prejudice test to define when the immigration exemption may restrict UK GDPR rights. The court held that the test is clear but must be accompanied by a legislative proportionality balance. (see paras [50], [52]-[57])
Makes use of the immigration exemption conditional on the Secretary of State having an immigration exemption policy document in place, but does not make that document a legislative source of safeguards. (see paras [21]-[23], [45]-[46])
Requires the policy document to explain policies and processes for applying the exemption and preventing abuse or unlawful access or transfer, but prescribes no substantive safeguards. (see paras [21]-[23], [64(1)])
Refers to preventing abuse of personal data, but merely repeating that expression gives it no operative content and does not provide Article 23(2)(d) safeguards. (see para [64(1)])
Lists the UK GDPR rights and obligations which the immigration exemption may restrict, thereby satisfying Article 23(2)(c) as to scope. (see paras [21], [58]-[60])
What each judgment says about Schedule 2, paragraph 4 is in the case-law panel in the full Act.