July 27, 2021

Volume XI, Number 208

Advertisement

July 27, 2021

Subscribe to Latest Legal News and Analysis

July 26, 2021

Subscribe to Latest Legal News and Analysis

UK Court of Appeal Signals It Will Closely Scrutinize UK DPA Exemptions

On May 26, 2021, the Court of Appeal handed down its judgment in the case of (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the UK 2018 Data Protection Act’s (“DPA 2018”) “immigration exemption” is unlawful.

The immigration exemption, found in paragraph 4 of Schedule 2 of the DPA 2018, permits those processing personal data for immigration control purposes to refuse to comply with the data subject rights guaranteed by the EU General Data Protection Regulation (“GDPR”) to the extent that complying with those provisions would prejudice those purposes. The Court of Appeal determined that this exemption is not compliant with the GDPR, which continues to form part of UK law.

The GDPR permits EU Member States to create exemptions in their national law from some GDPR obligations on the grounds of, for example, national security and public interest. Any such exemption, however, must be one that “respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society.” It also is necessary for the relevant exemption to include provisions relating to its purpose, scope, safeguards and risks (among other provisions). The Court of Appeal determined that while the exemption did address an important public interest, it did not include the required provisions and limitations.

The judgment indicates that UK courts will not hesitate to examine legislative measures that deviate from the GDPR’s obligations. It also may have wider implications for the adequacy determination sought by the UK from the European Commission, as the immigration exemption was highlighted as an issue of concern by the European Data Protection Board in its Opinion on the Commission’s draft adequacy decision.

Copyright © 2021, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XI, Number 147
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement