In R (Open Rights Group & the3million) v Secretary of State for the Home Department & Secretary of State for Digital, Culture, Media and Sport  EWCA Civ 800, the Court of Appeal has ruled that the immigration exemption in paragraph 4 of Schedule 2 to the Data Protection Act 2018 was not compliant with the requirements of Article 23 of the GDPR.
Warby LJ held that Article 23(2) must be interpreted to give it meaning, and that it adds materially to the requirements of Article 23(1) as a particularised set of specific requirements, which must be contained in the legislative measure which Article 23(1) permits. The derogation must be strictly necessary and proportionate, and the legislature must have directed its attention to the specific impacts the derogation would have. The Article 23(2) requirements must be met by a measure tailored to the derogation, is legally enforceable and contains provisions specific to the listed topics (where relevant, are precise and produce a reasonably foreseeable outcome. Identifying safeguards within the GDPR itself, or in wider administrative law, is insufficient. Warby LJ considered that the EDPB Guidelines 10/2020 on Article 23 supported this analysis.
Applying this approach, it was “clear” that the immigration exemption was non-compliant with Article 23 because it contains nothing, specific or otherwise, addressing any of the Article 23(2) matters. A legislative measure must require more than a non-binding code, and so the existing guidance published by the Information Commissioner (which has no particular legal status) could not fill the gap.
Further submissions have been sought on relief, and in particular whether the Court should strike down the immigration exemption as well as declare it unlawful and, if so, on what terms.
Christopher Knight acted for the Information Commissioner as intervener. The judgment may be read here.