In The Open Rights Group & Anor, R (On the Application Of) v The Secretary of State for the Home Department & Anor [2021] EWCA Civ 800, the Court of Appeal considered an appeal concerning the lawfulness of statutory restrictions on data protection rights, in the context of immigration.
The point of interest for this blog is the Court’s comments on the continuing relevance of the principle of the supremacy of EU law to cases involving conflicts between retained EU law and pre-exit domestic legislation.
The Court of Appeal neatly summarised the position for cases raising this problem in a short section headed “Brexit”:
The appellants’ challenge to the Immigration Exemption was launched on 24 August 2018, when the UK was still an EU Member State. The claimants’ case relied on the principle of supremacy of EU law. The claim was tried, and judgment was given, after “exit day”, 29 March 2019, but during the implementation period provided for by the withdrawal agreement. That period ended on 31 December 2020 (“IP completion day”). We heard the appeal in February 2021. But it is common ground that the UK’s withdrawal from the EU has not materially affected the position.
(1) Sections 2, 3 and 6 of the European Union (Withdrawal) Act 2018 (“EUWA”) provided for certain aspects of EU law to remain in force, as part of English law, notwithstanding withdrawal. This is known as “retained EU law”. The GDPR, DPA 2018, and relevant CJEU case-law pre-dating IP completion day all fell into this category.
(2) By section 5(2) of EUWA, the principle of the supremacy of EU law continues to apply “so far as relevant to the interpretation, disapplication or quashing of any enactment… passed or made before exit day”. What this means is explained in paragraph 103 of the Explanatory Notes:-
“Where … a conflict arises between pre-exit domestic legislation and retained EU law, subsection (2) provides that the principle of the supremacy of EU law will, where relevant, continue to apply as it did before exit. So, for example, a retained EU regulation would take precedence over pre-exit domestic legislation that is inconsistent with it.”
The Immigration Exemption is “pre-exit domestic legislation”.(3) A statutory instrument of 2019 made amendments to the GDPR and DPA 2018 with effect from IP completion day. As a result the GDPR, as it applies domestically, is now known as “the UK GDPR”. But the UK GDPR has the same legal status today as the GDPR had before IP completion day. Article 23 is now in slightly amended terms, but the amendments are not material. In Article 23(1), references to “the Union” and “Member State” are deleted and the power to restrict is now conferred on the Secretary of State. There is no change to Article 23(2). The Immigration Exemption is unamended.
The respondents accept that in these circumstances the Court could in principle make a declaration that the Immigration Exemption is contrary to Article 23 of the GDPR and Article 23 of the UK GDPR. They also accept that, in principle, the Court would also have the power to disapply the Immigration Exemption if it finds that provision to be incompatible with Article 23 of the UK GDPR.