The High Court in the case of R (Open Rights Group & the 3 million) v Secretary of State for the Home Department [2019] EWHC 2562 (Admin) has dismissed a challenge against the Immigration exemption to data protection rights in the General Data Protection Regulations (‘GDPR’).
The Immigration exemption was brought into force under paragraph 4, Schedule 2 of the Data Protection Act 2018, the UK’s domestic legislation on GDPR. The exemption removes the necessary protections afforded to data subjects and provides for limited disclosure of data, where certain criteria were met.
The challenge was brought by two campaign groups, the Open Rights Group, which works to protect digital privacy, and the 3 million, an organisation that supports the rights of EU citizens in the UK. The Information Commission (ICO) intervened in this case, and whilst agreeing that the exemption was in accordance with the law, they considered that statutory guidance was needed to ensure proper implementation of this exemption.
The Claimants argued that the exemption was too broad, and it was incompatible with Article 23 of GDPR, which requires restrictions on data rights to be proportionate. They argued that the exemption was too wide and vague, and therefore created a risk of abuse. Further, the Secretary of State had not put forward enough evidence to justify the need for this provision at all.
The High Court dismissed the challenge and stated that the exemption was a matter of ‘important public interest’. In its judgement, the Court noted that exemption in itself did not create a risk to data subjects, but instead requires data controllers to justify their use of the exemption.
In his judgement, the Court ruled that the exemption was required for the Defendants to effectively carry out their functions.
The Court also noted that whilst there were no safeguards within the exemption itself, this was not required, as the legislation as a whole provided for these.
Finally, the Court concluded that there was no need for additional statutory guidance, as the legislation itself was sufficiently clear.
We understand that the Claimants have sought permission to appeal to the Court of Appeal. Separately, the ICO submitted to the Court that it was finalising guidance which may have some legal footing under the ICO’s powers under Article 57(1) but would have no legal status under DPA 2018.