Two recent judgments increase pressure on UK government to respond to MEPs' rejection of the Commission's Draft Data Adequacy decision

By Joanne Bone from Irwin Mitchell 

It is to be expected two judgments handed down in the past 48 hours will impact on how the UK Government responds to Friday's resolution with MEPs voting to reject the Commission's Draft Data Adequacy decision for the UK.

Earlier this week a Court of Appeal judgment backed the EU Parliament's specific criticisms of immigration exemptions in Sch 2 Para 4 DPA 2018 on which the Home Office rely by ruling the exemptions incompatible despite representations from DCMS.

The impending hearing on relief in the case – yet to be listed - (Open Rights Group (1) the3million (2) v DCMS (with interventions from ICO & Liberty) represents additional pressure on the government to move quickly to ensure Brexit bridging provisions do not end on 30th June 2021 without a Data Adequacy decision between EU and UK in place.

Depending on how quickly the hearing date for relief is listed the government’s hand may be forced as the courts move more quickly to define the limits of the exemption for them.

In a second decision handed down by the European Court of Human Rights on Tuesday 25th May (Big Brother Watch & Ors v UK [2021] ECHR 439) arising out of the Snowden affair, it was ruled that the UK’s bulk interception regime (legislated for in the Investigatory Powers Act 2016) violated Articles 8 and 10 of the Convention due to not containing sufficient “end to end” safeguards in order to ensure adequate and effective guarantees were in place to protect against risk of abuse and arbitrary use. The UK regime for obtaining communications data from communication service providers was also ruled in violation of Articles 8 and 10.

Bearing in mind the ECJ’s decision last summer in Schrems II (catch up with our webinar Schrems II, GDPR and Brexit: are you prepared? 18/11/2020), a judgment referenced heavily in the European Parliament’s Friday resolution amidst specific criticisms made of the UK’s security services data sharing arrangements, the European Court of Human Right’s ruling couldn’t come at a more apt or inconvenient time, depending on whether or not you’re a government lawyer.

So for those of us keeping an increasingly tense watch on if and how the UK will achieve Data Adequacy status with the EU before 30th June 2021, much remains up in the air and will depend on events and responses from key players due to unfold in the coming weeks, now with two additional judgments to consider in the mix:

• A hearing on relief in Open Rights Group & Anor v DCMS will take place with further submissions of evidence requested beforehand. Lord Justice Warby in his judgment did not appear predisposed to ruling any options out available to the court for ordering relief but was equally mindful of the sensitivities surrounding the political minefield the court will now have to navigate in approaching what kind of relief could be granted.
  
  
• The European Parliament will have noted the decision in Big Brother Watch as further support for their stance on rejecting the draft UK Data Adequacy decision and expressing continued concern the UK’s data sharing agreement with the US

It remains to be seen how DCMS and the Home Office respond to Open Rights Group & Anor v DCMS on the issue of immigration exemptions but viewed in the context of Windrush and the Equalities and Human Rights Commission’s report issued last November accusing the Home Office of breaching equalities law with its ‘hostile environment’, is a prediction of bullish behaviour ignoring the jurisdiction of the courts outlandish? Or will a sensible and pre-emptive proposed amendment to Sch 2 DPA 2018 be forthcoming prior to a return to the Court of Appeal?

Perhaps a clue to government sentiment can be gleaned from the National Data Strategy issued for consultation by DCMS last Thursday, less than 24 hours prior to the MEPs’ resolution on Data Adequacy, in which DCMS said that the UK would issue its own adequacy decisions to “fast growing economies”. Does this mean that adequacy will be tagged on to trade deals in just the way MEPs feared?

For more on this fast-moving area please see our most recent webinars covering GDPR – Three Years On (20/05/21) and Impact of the Brexit Deal on GDPR and Data Protection (27/01/21)