Substantial compliance just won’t do: Supreme Court on international data transfers under DPA Part 3

March 30th, 2020

Foreign fighters. Law enforcement cooperation with the US. The death penalty. A seven judge bench in the Supreme Court. Despite showing all the signs of a landmark public law decision, Elgizouli v Secretary of the State for the Home Department [2020] UKSC 10 was a bit of a fizzer on that front. In the end, the real meat was in the DPA 2018’s regulation of law enforcement processing and international data transfers.

Two questions were posed for the Court. The first was the kind that excites the policy-minded: did the common law stand in the way of the Secretary of State providing mutual legal assistance to a foreign state which might facilitate the imposition of the death penalty? (For those Panopticon readers with interests that extend beyond information law, the answer was “No”.)

The second question was whether the law enforcement processing provisions of the DPA 2018 (Part 3) stood in the way of providing such assistance. The answer was a resounding (in fact, unanimous) “Yes”.

For a reminder of the background, see the original post on the Divisional Court proceedings here.

In short, the Claimant was the mother of a man accused of being a foreign fighter in Syria and carrying out (to use the words of the Lord Kerr) “heinous offences” (§16). She sought judicial review of the Home Secretary’s decision to provide mutual legal assistance to the US in the prosecution of her son.

The longstanding policy of the UK government was to require an assurance that the death penalty would neither be sought, nor imposed (or if imposed, not carried out) where such assistance was provided. To grossly oversimplify the chronology (see Lord Kerr’s detailed outline of the background at §§16-61): the US refused to give the assurance, the Home Secretary gave the assistance anyway by providing “many” witness statements.

In the Supreme Court, two points were uncontroversial.

First, all accepted they were in DPA 2018 Part 3 territory. The provision of the witness statements constituted the processing of personal data for a law enforcement purpose by a controller who was a competent authority for the purposes of Part 3 of the DPA 2018.

Second, in processing the data the Home Secretary did not expressly consider his duties under the DPA 2018.

While the Divisional Court considered that there was “substantial compliance” with the Act and that this was sufficient, that argument failed to land in the Supreme Court. Lord Carnwath (with whom all agreed either explicitly or in substance) gave the leading judgment on the data protection point.

Part 3 of the DPA 2018 implements the Law Enforcement Directive (Directive (EU) 2016/680). It provides that international data transfers for law enforcement purposes can take place where three conditions are satisfied: s 73(1)(a). The second condition required the transfer to be “based on” either (a) an adequacy decision; (b) there being appropriate safeguards; or (c) “special circumstances”.

No one suggested there was an adequacy decision. The primary issue was therefore whether conditions 2(b) or (c) were in play.

The substance of conditions 2(b) and 2(c) is expanded upon in sections 75 and 76. Both include requirements that aspects of the transfer (including the justification) be documented and certain information be provided to the Information Commissioner.

Lord Carnwath accepted the submission of the Commissioner that:

Section 73 requires … “conscious and contemporaneous” consideration of the statutory tests prior to any transfer taking place. Further, the record-keeping requirement, including the requirement to set out the “justification for the transfer”… cannot sensibly be read as requiring no more than ex post facto consideration of whether a transfer was justified … (at §218)

In circumstances where the Secretary of State had failed to consider whether there were “appropriate safeguards” (§220) that argument got short shrift. It didn’t help that Recital 71 to the Directive – explaining the “appropriate safeguards” issue – included the rider, “In addition, the controller should take into account that the personal data will not be used to request, hand down or execute a death penalty …” (emphasis added). In light of this, Lord Carnwath went so far as to suggest that, even if the Secretary of State had considered the issue, he could not have been satisfied that there were “appropriate safeguards”: §220 (but note §6 per Lady Hale).

As to Condition 2(c), “special circumstances” were defined in section 76. In essence, the transfer had to be “necessary” (strictly so: see Recital 72 of the Directive) for one of a number of specified purposes. Lord Carnwath concluded the decision was based upon “political expediency, rather than strict necessity under the statutory criteria”: §227. Similarly, Lord Kerr considered special circumstances was not available because the section 76 required “direct, personal evaluation” as to what was “strictly necessary”: §158. The transfer was accordingly unlawful.

The takeaway? International transfers of data for law enforcement purposes require strict compliance with the terms of the DPA 2018 Part 3. Section 73 requires “specific consideration by the relevant controller of the statutory tests, including the strict test of necessity. The clear purpose of the provisions is to set out a structured framework for decision-making, with appropriate documentation”: §219.

Data controllers operating outside the law enforcement space should take note of this judgment as well. As one of the few decisions to consider the DPA 2018, and the only one from the Supreme Court, it may well set the tone for lower courts to demand stricter compliance more broadly. Further, the GDPR provisions concerning international data transfers are similar in structure and form to Part 3. We can probably expect to see this decision rolled out in other contexts, including as a guide to the proper interpretation of (at least) Art 49 (derogation for specific situations) – the GDPR equivalent to section 76.

Christopher Parkin

@parkinchris

Comments are closed.