Case Law Update April 2020

Introduction

The Supreme Court has allowed an appeal against a decision of the Home Office, finding unanimously that the decision failed to comply with the Data Protection Act 2018.

The decision to which the appeal relates was the decision of the Home Secretary to provide information about a member of a terrorist group to the US Government. The Home Secretary initially requested an assurance that the information would not be used in a prosecution that could lead to the imposition of the death penalty. The US refused to provide such an assurance and the Home Secretary subsequently released the information anyway.

The decision to provide the information was challenged. One of the questions of public importance which emerged was whether or not it is lawful under Part 3 of the Data Protection Act 2018 to transfer personal data to law enforcement authorities abroad for use in capital criminal proceedings. As can sometimes be the case, data protection considerations can raise more interesting questions than people (other than privacy lawyers!) anticipate.

Background

Part 3 of the Data Protection Act 2018 (DPA) regulates the processing of personal data by law enforcement organisations for the purposes of the prevention, investigation, detection or prosecution of criminal offences, including the safeguarding against and the prevention of threats to public security. The aim of Part 3 is to achieve a balance between the rights of individuals who are under investigation and the ability of law enforcement organisations to bring them to justice. This part of the DPA 2018 strengthens the rights of data subjects whilst also enabling a controller to restrict these rights where necessary to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences – for example by revealing to a person that they are under investigation.

Summary of the decision

The court was unanimous in holding that the Home Secretary's decision was unlawful under the DPA, for various reasons, including that the fundamental rights and freedoms of the data subject, particularly (in this case) his right to life, should have been considered when his personal data was transferred to a third county for law enforcement purposes. The Court’s finding that this most fundamental right was not properly considered was one reason for which the Court held that the Home Secretary’s decision could not stand. Another reason was the finding that the decision was based on political expediency, rather than the consideration of strict necessity required by the DPA.

Comment

From a data protection perspective, the decision is interesting for two reasons. Firstly, because of the finding that political expediency was a key factor in the decision, rather than the requirement that the transfer be considered necessary for law enforcement purposes. Secondly, because Lady Hale’s interpretation that an individual’s fundamental rights and freedoms include the right to life suggests that this particular section of the DPA (see s76(2)) will not, in future, allow the transfer of personal data to facilitate a prosecution which could result in the death penalty.

The decision will no doubt ensure that the Home Office reflects more carefully in future on the requirements of data protection legislation when transferring personal data to a foreign government.