Search
In R (the3million and Open Rights Group) v SSHD and SSDCMS [2023] EWHC 713 (Admin) the High Court found unlawful the UK Government’s second attempt to enact statutory restrictions on data protection rights in the context of immigration control.
The Court of Appeal previously held in R (Open Rights Group & The3Million) v SSHD & SSDCMS [2021] EWCA Civ 800 that an earlier version of the Immigration Exemption under the Data Protection Act 2018 was incompatible with retained EU law. The Government subsequently enacted the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022 (SI 2022/76), amending the DPA 2018 in light of the Court of Appeal’s decision. The Claimants made a further challenge to the revised version of the Immigration Exemption, arguing that Government’s second attempt failed to remedy the defects identified in the first claim and remained in breach of Article 23 of the UK GDPR.
Saini J agreed, allowing the Claimants’ challenge and holding that “the overriding matter which needs to be addressed by the Defendants is the use of a policy to set out the safeguards and tests to be applied in using the Immigration Exemption. … the measures to satisfy the relevant provisions of Article 23(2) need to be set out in either legislation, or a code endorsed by Parliament, with binding legal effect in domestic law.” He therefore made a declaration that the Immigration Exemption is unlawful but suspended that order for a period of three months, to allow the Defendants an opportunity to put in place compliant legislation.
The judgment is available here.
Nikolaus Grubeck and Julianne Kerr Morrison acted for the successful Claimants, instructed by Leigh Day.