The UK GDPR, the Immigration Exception and Brexit: Interrogating Open Rights Group v Secretary of State for the Home Department and its Aftermath

Abstract

This note explores the holding, context and aftermath of the judgments which declared the so‐called ʻimmigration exceptionʼ set out in the UK Data Protection Act 2018 incompatible with, and assumed it subject to, the (UK) General Data Protection Regulation (GDPR) restrictions clause (article 23). The subsequent limitation of this exemption's use to the government is impactful in itself. However, this case has much wider significance. Firstly, the finding that the restrictions clause mandates granular specificity places in jeopardy many exemptions not only in the UK but also in EU States. Secondly, the assumption that this article was engaged is questionable since, as reworded post‐Brexit, it is restricted to limitations laid down in delegated legislation. Nevertheless, this rewording depended on powers limited to addressing post‐Brexit technical ʻdeficienciesʼ and so is ultra vires . The Court of Appeal should have addressed this in order to vindicate the rule of law and separation of powers.