The UK Court of Appeals is signaling that it will scrutinize the UK Data Protection Authority’s exemptions
On May 26, 2021, the Court of Appeal pronounced its verdict in Case R (Open Rights Group and the3million) against Secretary of State for the Home Department and Others  EWCA Civ 800, which states that the “Immigration Exemption” of the UK 2018 Data Protection Act (“DPA 2018”) is unlawful.
The immigration exception in accordance with paragraph 4 of Annex 2 of the DPA 2018 allows persons who process personal data for immigration control purposes to comply with the rights of the data subject guaranteed by the EU General Data Protection Regulation (“GDPR”) insofar as compliance with these provisions harm these purposes would. The appeals court found this exception to be inconsistent with the GDPR, which continues to be part of UK law.
The GDPR allows the EU member states to provide for exceptions to some GDPR obligations in their national law, for example for reasons of national security and the public interest. However, such an exception must “respect the essence of fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society”. It is also required that the relevant exception contain provisions regarding the purpose, scope, warranties, and risks (among other provisions). The appeals court found that while the exception served an important public interest, it did not contain the necessary provisions and restrictions.
The ruling suggests that UK courts will not hesitate to review legislative measures that depart from the obligations of the GDPR. This may also have wider implications for the adequacy assessment sought by the UK with the European Commission, as the European Data Protection Board highlighted the immigration exemption as worrying in its opinion on the Commission’s draft adequacy decision.