The UK Court of Appeals is signaling that it will look closely at the UK Data Protection Authority’s exemptions
On May 26, 2021, the Court of Appeals issued its ruling on Case R (Open Rights Group and the3million) against Secretary of State for the Home Office and others  EWCA Civ 800 declaring that the “Immigration Exemption” of the UK Data Protection Act 2018 (“DPA 2018”) is illegal.
The immigration exception in accordance with paragraph 4 of Annex 2 of the DPA 2018 allows persons who process personal data for immigration control purposes to refuse compliance with the rights of the data subject guaranteed by the EU General Data Protection Regulation (“GDPR”) insofar as compliance with these provisions harms these purposes would. The appeals court found this exception to be inconsistent with the GDPR, which continues to be part of UK law.
The GDPR allows the EU member states to create exceptions to some GDPR obligations in their national law, for example due to national security and the public interest. However, such an exception must be one that “respects the essence of fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society”. The relevant exception regulation must contain provisions on the purpose, scope, protective measures and risks, among other things. The appeals court found that the exemption, while affecting an important public interest, did not contain the necessary provisions and restrictions.
The ruling shows that the UK courts will not hesitate to review legislative measures that depart from the obligations of the GDPR. This can also have far-reaching implications for the adequacy determination requested by the UK from the European Commission, given that the immigration exemption was highlighted as a matter of concern by the European Data Protection Board in its opinion on the Commission’s draft adequacy decision.