The 3Million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

The 3Million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor

The amended Immigration Exemption fails to comply with Article 23(2) of the UK GDPR because the necessary safeguards are not set out in legislation but in a policy document (IEPD) that is not subject to Parliamentary scrutiny or binding legal force. This undermines the rule of law and the requirement for specific, legally binding safeguards for derogations from data subject rights.

Parties
Claimant/respondent: THE 3MILLION; Claimant/respondent: OPEN RIGHTS GROUP; Defendant/appellant: SECRETARY OF STATE FOR THE HOME DEPARTMENT; Defendant/appellant: SECRETARY OF STATE FOR SCIENCE, INNOVATION AND TECHNOLOGY; Interested Party: THE INFORMATION COMMISSIONER
Jurisdiction
England and Wales
Judgment Date
11 October 2024
Procedural Posture
Judicial Review (appeal) / Appeal From High Court Judgment
Outcome
Appeal dismissed
Legal Topics
GDPR, Immigration Exemption, Legislative Safeguards, Parliamentary Scrutiny, Fundamental Rights
Data Protection Constitutional Law Administrative Law GDPR Immigration Exemption Legislative Safeguards Parliamentary Scrutiny Fundamental Rights

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 3 Authorities cited 17 Party arguments 2
Sign in to unlock

Parties

THE 3MILLION

Claimant/respondent

OPEN RIGHTS GROUP

Claimant/respondent

SECRETARY OF STATE FOR THE HOME DEPARTMENT

Defendant/appellant

SECRETARY OF STATE FOR SCIENCE, INNOVATION AND TECHNOLOGY

Defendant/appellant

THE INFORMATION COMMISSIONER

Interested Party

Procedural Posture

Judicial Review (appeal) / Appeal From High Court Judgment

Legal Issues

  1. 1 Whether the amended Immigration Exemption under the Data Protection Act 2018 complies with Article 23(2) and (3) of the UK GDPR
  2. 2 Whether legislative safeguards and specificity required by Article 23(2) are met by the Regulations and/or the Immigration Exemption Policy Document (IEPD)
  3. 3 Whether the Regulations provide sufficient procedural and substantive safeguards, including Parliamentary scrutiny, to justify derogation from data subject rights

Ratio Decidendi

The amended Immigration Exemption fails to comply with Article 23(2) of the UK GDPR because the necessary safeguards are not set out in legislation but in a policy document (IEPD) that is not subject to Parliamentary scrutiny or binding legal force. This undermines the rule of law and the requirement for specific, legally binding safeguards for derogations from data subject rights.

Court Disposition

Appeal dismissed

Orders

  • Declaration that the Immigration Exemption is incompatible with Article 23 of the UK GDPR is upheld
  • Suspension of the declaration for three months from the date of the order to allow for remedial legislation