You have to admire the ingenuity of lawyers. Who would have thought that the GDPR could be a tool to try and force the Home Office to allow a deported overstayer with a lengthy criminal record back into the UK to conduct an in-person appeal? Not the Court of Appeal for a start in Johnson v Secretary of State for the Home Department [2020] EWCA Civ 1032.
Mr Johnson had been deported to Jamaica and was required, by the provisions of the Nationality, Immigration and Asylum Act 2002 to appeal to the First-tier Tribunal out of country. He did not wish to do so; he wished to be permitted to enter the UK to make his appeal. Accordingly, he notified the FTT that he did not consent to giving oral evidence by video link and he did not consent to the electronic transfer of the hearing bundle to the British High Commission in Jamaica. He raised various arguments under the GDPR in support of his position. The FTT rejected these objections, as did the Upper Tribunal (comprised of Lane CP, Judge Wikeley and Judge O’Connor).
The leading judgment of Dingemans LJ contains a number of useful and interesting observations. He declined to determine whether the data processing was in the scope of EU law or not as the terms of the applied GDPR would be materially the same. He noted that both the FTT and the Home Office were controllers of the Appellant’s personal data, which included special category data under Articles 9 and 10. He reiterated the observation of the Supreme Court in R (Elgizouli) v Secretary of State for the Home Department [2020] UKSC 10 that any limitation on the right to data protection must be strictly necessary and justified on the basis of objective evidence.
The Appellant’s position was characterised, at least primarily, as an exercise of the right to object under Article 21 GDPR. Dingemans LJ held that the FTT proceedings were encompassed within the exception for “for the establishment, exercise or defence of legal claims” in Article 21(1), particularly the Appellant’s Article 8 ECHR assertion, and the Home Office’s defence of it. Although essentially duplicative, Dingemans LJ also accepted that the exceptions in paragraphs 5 (information required to be disclosed…in connection with legal proceedings) and 14(3) (prejudice to judicial proceedings) of Schedule 2 would also apply so as to permit an exception to the Appellant’s objection. The fact that an appeal could take place in the UK did not render processing for the purposes of an out of country appeal under the legislative framework disproportionate, and for that appeal to be fair, the data in the form of the hearing bundle was required. It is worth noting the brief suggestion in the concurring judgment of Green LJ that whether the reason for which the Article 21 objection is made might be relevant – particularly given the language of “on grounds relating to his or her particular situation” – and could be returned to, noting the context of an Appellant who might (fairly or unfairly) to be thought to be stymying the immigration appeals process on the basis that he did not like or trust the Home Office.
There was also an issue about whether the Appellant’s right to erasure under Article 17 was properly assured, but the Court of Appeal accepted the findings of the FTT that reliable assurances had been given that the data transferred to the British High Commission would be destroyed after seven days.
The most interesting issue was the application of the international transfers provisions, the discussion of much of which on the part of Dingemans LJ and the short judgment of Green LJ (with both of whom Lewison LJ agreed) being obiter. As Green LJ rightly emphasised at [73], an international transfer imposed additional restrictions, but did not mean one could ignore the prior questions.
The short answer – and obviously correct answer – was that the transfer was justifiable under Article 49(1)(e) GDPR (necessary for the establishment and defence of legal claims). The more interesting argument advanced by the Secretary of State was that a transfer solely to the British High Commission in Jamaica was, in truth, not an international transfer at all (or at least not in any relevant sense) because the data never left the control of British officials. The Upper Tribunal had accepted this on a purposive interpretation. Dingemans LJ (very briefly) and Green LJ (at greater length) were rather more doubtful about this, particularly doubting that one could read into Article 46 a complex limitation based on consular and diplomatic premises, where the degree of protection might well vary from case to case. Green LJ also added that he accepted that Article 46 would apply on the facts of the case, because there were adequate safeguards in place in the context of this particular transfer and the risk was relatively low. This is perhaps a slightly compressed consideration of what might be required under an Article 46 analysis (and the reference to Dingemans LJ having agreed, at [75], is not at all clear in the judgment of Dingemans LJ) but one can see the logic. The issue was left for a case in which it mattered, although it is doubtful whether a transfer to a consulate will be unable to identify an Article 49 basis as a more straightforward route.
All in all, data protection law continues to seep into every area of law. Quite right too.
Christopher Knight