On May 26, 2021, the Court of Appeal handed down its judgment in the case of R (Open Rights Group and the3million) v Secretary of State for the Home Department and Others [2021] EWCA Civ 800, finding that the UK 2018 Data Protection Act’s (“DPA 2018”) “immigration exemption” is unlawful.

The immigration exemption, found in paragraph 4 of Schedule 2 of the DPA 2018, permits those processing personal data for immigration control purposes to refuse to comply with the data subject rights guaranteed by the EU General Data Protection Regulation (“GDPR”) to the extent that complying with those provisions would prejudice those purposes. The Court of Appeal determined that this exemption is not compliant with the GDPR, which continues to form part of UK law.

The GDPR permits EU Member States to create exemptions in their national law from some GDPR obligations on the grounds of, for example, national security and public interest. Any such exemption, however, must be one that “respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society.” It also is necessary for the relevant exemption to include provisions relating to its purpose, scope, safeguards and risks (among other provisions). The Court of Appeal determined that while the exemption did address an important public interest, it did not include the required provisions and limitations.

The judgment indicates that UK courts will not hesitate to examine legislative measures that deviate from the GDPR’s obligations. It also may have wider implications for the adequacy determination sought by the UK from the European Commission, as the immigration exemption was highlighted as an issue of concern by the European Data Protection Board in its Opinion on the Commission’s draft adequacy decision.