Giving migrants in the UK reduced data protection rights without proper safeguards is unlawful, the Court of Appeal held yesterday. The judgment overturns a 2019 High Court ruling and is a significant victory for the campaign groups involved, who have long campaigned against the so-called “immigration exemption”. The case is R (Open Rights Group & the3million) v Secretary of State for the Home Department & Anor [2021] EWCA Civ 800.

The immigration exemption

Data protection laws give people various rights over their personal information, including to request a copy of what an organisation has on file about them. Nick has described this particular right as “crucial” for people trying to get information about their immigration case out of the black box that is the Home Office.

But the Data Protection Act 2018, unlike its 1998 predecessor, contains an exemption. Paragraph 4, Schedule 2 says that the right of access to one’s data (among others) does not apply in the context of “immigration control”.

The claimants object to this status of affairs and have been trying to get the immigration exemption condemned as unlawful. In the High Court in October 2019, Mr Justice Supperstone backed the Act.

Remember GDPR? 

How, you may ask, were the claimants supposed to get a provision of an Act of Parliament declared unlawful? The answer, as the Court of Appeal explains with admirable clarity, is that certain European Union legislation such as the General Data Protection Regulation (GDPR) used to take precedence over incompatible UK legislation as matter of EU law. Post-Brexit, most such laws have been carried over, with that principle of supremacy maintained — no longer because of EU membership, but as a matter of UK law.

GDPR is part of that “retained EU law”. Parts of the Data Protection Act that conflict with GDPR can therefore be declared unlawful or struck down entirely, although Parliament could change the retained UK version of GDPR in future. 

GDPR being in play, the Court of Appeal found the case pretty easy to resolve.

Immigration exemption in breach of GDPR

Bespoke exemptions from data rights like the immigration exemption are only possible under the terms of Article 23 of GDPR. But any exemption must contain provisions addressing a “checklist” of safeguards in Article 23(2) — otherwise it won’t count.

Or, as Lord Justice Warby put it: 

…. it seems to me that on the face of it Article 23(2) contains a condition precedent to the validity of any “legislative measure” purporting to fall within Article 23(1): the measure can only satisfy the requirements of Article 23(1) if it contains specific provision as to each matter that (a) is listed in Article 23(2) and (b) is, in the circumstances, relevant to an assessment of whether the measure (i) respects the essence of the right in question and is (ii) necessary and proportionate for one or more of the listed purposes or objectives.

The immigration exemption “contains nothing, specific or otherwise, about any of the matters listed in Article 23(2)”. Game over.

… this appeal can and should be decided on the following short and straightforward basis. There presently exists no legislative measure that contains specific provisions in accordance with the mandatory requirements of Article 23(2) of the GDPR. In the absence of any such measure, the Immigration Exemption is an unauthorised derogation from the fundamental rights conferred by the GDPR, and therefore incompatible with the Regulation. For that reason, it is unlawful.

That said, the court did not strike down the immigration exemption outright. Warby LJ noted that the problems could be fixed by amendments to bring the legislation up to code. The court therefore deferred a decision on whether to “disapply” the exemption altogether or merely issue an official declaration that it is unlawful and leave the ball in Parliament’s court. So the exemption remains in place in the very short term; and perhaps the government will seek to appeal to the Supreme Court.

But assuming the exemption is ultimately scrapped or significantly revised, that will benefit all migrants’ access to their data — not just EU citizens.

Maike Bohn of the 3million said that “winning the appeal means we can hopefully reintroduce much-needed scrutiny so errors and data misuse cannot go undetected”.