Data protection, the death penalty and mutual legal assistance in criminal law: Elgizouli v Secretary of State for the Home Department [2020] UKSC 10

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

Elgizouliis the first UK Supreme Court judgment on the Data Protection Act 2018 (DPA).  The headline news is that ‘substantial compliance’ with the requirements set down in the Act is insufficient to make data transfers to third countries lawful. The judgment concerns Part Three, which implements the Law Enforcement Directive (Directive (EU) 2016/680) and focusses on procedural protections, but in terms of approach may have implications for the UK courts’ approach to the DPA and General Data Protection Regulation (GDPR) more generally, especially as it relates to the protection of individual rights found in the European Court of Human Rights (ECHR).

Facts

Eligizouli’s son was implicated in the murder in Syria of UK and UK citizens. As part of its investigations into the group responsible for the murders, the US made a mutual legal assistance (MLA) request to the UK, asking for information to be transferred. Theresa May, as Home Secretary, requested that the information would not be used either directly or indirectly in a prosecution that could lead to the imposition of the death penalty, an assurance the US did not give. Nonetheless, Sajid Javid, a subsequent Home Secretary, agreed to provide the information.

Eligizouli brought an action for judicial review, raising two questions: (1) whether the common law precluded the Secretary of State from exercising his or her powers in this way; and (2) whether such a transfer was lawful under the DPA understood in the light of EU law.  Specifically, the appellant argued that the Home Secretary’s decision was an unlawful breach of:

1)      the first data protection principle in section 35 of the Act;

2)      the second data protection principle in section 36;

3)      the provisions governing international transfers of personal data for law enforcement purposes in sections 73 to 76; and

4)      the special processing restrictions in section 80.

It was further argued that the Home Secretary had paid no regard to the duties imposed on him by the DPA. At first instance, the Divisional Court had held that the Home Secretary had demonstrated “substantial compliance” with the Act and that “special circumstances” could be relied on in relation to the transfer.

Judgment

The Supreme Court (by a majority) found that the common law had not evolved to a point where it recognised a principle prohibiting the provision of MLA that would facilitate the death penalty.  The Court was, however, unanimous in holding that the Home Secretary’s decision was unlawful under the DPA, specifically as regards the conditions under which data can be transferred to another jurisdiction and the leading judgment was given by Lord Kerr (although he was in  the minority on the common law point). Lady Hale’s judgment constitutes, in her words, a ‘short guide to the judgments’ [2].

There was agreement between all parties that Part 3 was in issue – that is, that there would be processing of personal data for a “law enforcement purpose” by a controller which is also a “competent authority” for the purposes of the Part 3 of the DPA.  It was also common ground that the Home Secretary did not expressly consider his duties under the DPA.

The main focus of the judgment was the conditions surrounding the transfer of the data to the US; the relevant provisions are found in ss. 73-76. Specifically, data cannot be transferred unless the three conditions in s 73(1)(a) are met. The first, in s. 73(2), is that “the transfer is necessary for any of the law enforcement purposes”. Section 73(3) contains the second condition. It lists three circumstances in which a transfer may take place:

1)      when it is based on an adequacy decision (simplifying data transfers) as set out in s. 74;

2)      if there is no such adequacy decision, then there are appropriate safeguards in accordance with s. 75; or

3)      if neither (1) nor (2) apply, is based on special circumstances in accordance with s. 76.

The third condition relates to the recipient of the information. 

The Court was agreed that the Home Secretary’s decision was not based on an adequacy decision, nor were there appropriate safeguards in the sense of s. 75. As Lady Hale remarked, “[t]his transfer was not based on an adequacy decision or on there being appropriate safeguards, because there were none” [10]. The issue of whether the decision was lawful would therefore depend on whether special circumstances existed; the Court did not consider whether special circumstances could only be relied on if neither of the other two categories apply. Section 76(1) specifies that special circumstances will apply if the transfer is necessary for one of five listed purposes:

1)      to protect the vital interests of the data subject or another person;

2)      to safeguard the legitimate interests of the data subject;

3)      for the prevention of an immediate and serious threat to the public security of a member State or a third country;

4)      in individual cases for any of the law enforcement purposes, or

5)      in individual cases for a legal purpose.

Section 31 DPA defines the law enforcement purposes. It would seem that s. 76(1)(d) and (e) are relevant here, but they are subject to a further control. Section 76(2) specifies they “do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer”. Further, according to s 76(3), the transfer must in all cases be documented.

Special circumstances, according to the Court, requires a specific assessment of whether these conditions are satisfied. The Court stated that the purpose of section 73 was to “set out a structured framework for decision-making, with appropriate documentation” [219] and, as the ICO submitted, requires:

 ‘conscious and contemporaneous’ consideration of the statutory tests prior to any transfer taking place. Further, the record-keeping requirement, including the requirement to set out the ‘justification for the transfer’ … cannot sensibly be read as requiring no more than ex post cosideration of whether a transfer was justified [218].

This was lacking here and the fact that the Home Secretary did not have regard to his duties as data controller meant that the special circumstances basis for transfer was not available [158]. Lord Carnwath sugggested here that the decision was based on political expediency rather than strict necessity as required by the statute [227] – Lord Kerr took a similar view.

There was a further question about impact of ‘fundamental rights and freedoms’ in s 76(2) – this per Lady Hale includes right to life in Art 2 ECHR. She argued, albeit obiter dicta, that this points towards an interpretation of s 76(2) so as to preclude a transfer of personal data to facilitate a prosecution which could result in the death penalty [26]. Lord Carnwath states that a failure to consider the point is a further reason that the Home Secretary’s decision cannot stand [228]; Lord Hodge sees the force of this point but as it was not fully argued reserves his position.

Lord Kerr took a different view, arguing that the processing (ie through the transfer of data as part of the MLA) was not lawful and fair – ie did not comply with the data protection principles in s. 34 DPA. He came to this conclusion because he, alone out of the judges, had taken the view that the common law would prevent the Home Secretary from acting in this way.

Comment

On one level the judgment could be seen as narrow; providing protection only through procedural mechanisms, leaving the Home Secretary free to make the same decision again, having directed her mind to the issues. Similarly, in its approach to the common law and the need for incremental development, the court is showing deference to the primacy of the legislature (see paras 170 and 233), especially in the context of the exercise of prerogative powers.  However, in its interpretation of the DPA and more particularly in the way it approached how the provisions should be interpreted, the judgment has a broader significance.  Indeed, its approach is in marked contrast to that of the lower courts, which may now change direction.

The Supreme Court here is emphasising the importance of data controllers actively engaging with the requirements imposed by the DPA; here the concerns stemmed from the fact that the Home Secretary “did not address his mind to the 2018 Act at all” [6]. So it seems that to be able to use any of the gateways in s. 73, consideration must be given to the protections in place, whatever the mechanism used. In terms of both the gateway based on appropriate safeguards and that which requires special circumstances, Lord Carnwath makes an important distinction between a decision which takes factors into account and one which is based on there being appropriate safeguards or special circumstances [219]. This distinction operates to raise the threshold of the standards required. The Supreme Court did not address the question of whether the three gateways operate in a hierarchy; that is each must be considered and discounted before moving on to the next. This would, as the respondents argued, place an additional burden on them.

The Supreme Court also confirmed the approach to understanding ‘necessary’ in s. 76(1) regarding the objectives in relation to which special circumstances may arise, which should be understood in the light of recital 72 to the LED. While the Divisional Court had used recital 72 to try to justify seeing this particular case as not being problematic (the recital gives the example of mass surveillance), The Supreme Court emphasises that any transfer must be ‘strictly necessary’ (rather than ‘necessary’ as in the DPA). Lady Hale referred to the judgment of Warby J in Guriev v Community Safety Development (UK) Ltd ([2016] EWHC 643 (QB)) who said

The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest” (para 45)

While this may leave questions about the meaning of necessary and proportionality and their relationship to one another (a common question), it is clear that the scope of s. 76 is to be narrowly interpreted – as indeed is the general approach under EU law to derogations – and that the proportionality of the transfer must be considered.

Lady Hale’s obiter views on s 76(2) DPA (which the rest of the Court accepted had force) also indicate that the Supreme Court is taking a strict approach to compliance here.  Her argument accepts that even if a transfer is necessary and proportionate it may still be overridden by the rights of the data subject – as found in a range of instruments, including the ECHR. These rights are not limited to data protection and privacy rights but include any of the rights so protected. Lady Hale expressly identifies the right to life (Art 2 ECHR). This means that the protection awarded is not just procedural but could include an assessment of the substance of the rights. Significantly, she made the point that fundamental rights are protected whatever the person’s nationality or place of residence and, implicitly, that these protections may have an extraterritorial effect. That is, they protect not just the rights of data subjects who remain within the jurisdiction once their data are transferred but possibly also those data subjects who are outside the jurisdiction when their data are transferred by a controller within the jurisdiction.

The judgment is clearly important for the transfer of data under the LED, but the provisions on data transfer in that context bear some similarity to the structure to that of Art 49 GDPR dealing with transfers in specific situations. It is not hard to imagine that a similar analytical methodology could be applied by the British courts if confronted with such a case.

The final question is what impact, if any, might this decision have on the possibility of a data protection adequacy decision for the UK from the EU Commission after Brexit (which would simplify the transfer of data from the EU to the UK). On the one hand, this shows that the administration got things very wrong, which might count against an adequacy decision; conversely, the approach of the Supreme Court might provide reassurance that there is effective oversight of data protection rights by independent courts in the UK. It could then come down to how the Government reacts to the Supreme Court’s judgment.

Photo credit: David Iliff, via Wikicommons

Continue reading Data protection, the death penalty and mutual legal assistance in criminal law: Elgizouli v Secretary of State for the Home Department [2020] UKSC 10

Prorogation of Parliament: Conflicting judgments in England and Scotland

Alan S. Reid, Senior Lecturer in Law, Sheffield Hallam University. The author welcomes comments on the blog at a.s.reid@shu.ac.uk.

The A-Z of Scots Law: From Avizandum to the Zany Antics of Boris Johnson

The recent, zany antics of Prime Minister Boris Johnson are being subject to intense interrogation by the Scottish legal system. The case of Cherryhas seen the decision to prorogue the UK Parliament declared unlawful and the Prime Minister’s reported defianceto refuse to comply with the specific terms of the European Union (Withdrawal) (No.2) Act2019 will be litigated upon in the Scottish courts next week. This new statute is designed to avoid a No-Deal Brexit on Halloween. It requires the Prime Minister to send a letter to the European Council requesting an extension to the Article 50 TEU negotiating period by the 19th of October 2019 if there is no deal in place (or no vote by parliament approving a no deal outcome) between the UK and EU by that date. 

These developments have exposed non-Scots lawyers and the general public in the UK to a whole new lexicon. In the Cherry case, they were treated to the terms ‘Avizandum’ and ‘stymie’ and in the prospective case forcing Boris Johnson to comply with the 2019 law, the general populace encountered the Latin term ‘nobile officium’.

The term ‘Avizandum’ is a Scots law term of art indicating that the court will take time to consider its judgment and deliver its reasoning at a later date. The word ‘stymie’ has been used in the case of Cherry to refer to the fact that proroguing Parliament will frustrate Parliament’s ability to scrutinise the work of the Executive while it is suspended. The etymology of ‘stymie’ is Scottish and refers to someone who can’t see very well and it was adopted as a golfing term to refer to a ball that prevents their opponent from having a clear shot at the hole. Thus, it is an apposite term for the actions of a Prime Minister attempting to deflect Parliament’s attention away from a No-Deal Brexit.

The ‘nobile officium’ is an ancient power of the supreme court of Scotland (the Court of Session) to offer an equitable remedy for pursuers when there is a perceived deficiency in the law.

This blog will discuss the significance of the unanimous decision of the Scottish judges in Cherry to declare the Prime Minister’s prorogation of Parliament unlawful, compare and contrast this with the English High Court’s decision to refuse to rule on the matter in Miller 2 and the potential ramifications of these cases for the Supreme Court hearing on Tuesday the 17th of September 2019. (For an overview of the prorogation case law with links, see here).

The original Cherrycase (discussed here) was the first legal test of Boris Johnson’s decision to prorogue Parliament. At first instance, Lord Doherty roundly rejected the petitioner's pleas, holding that the decision to prorogue was an exercise of prerogative power (ie non-statutory) by the executive (the Government) that was non-justiciable (ie not amenable to review by a court), since it involved matters of high policy and political judgment. Thus, such matters were best left to be resolved in the political arena, primarily by the Prime Minister being held accountable for his actions by his equals in Parliament and subsequently by the electorate at the ballot box.

South of the border, Gina Miller, Shami Chakrabarti and Sir John Major instigated a similar claimagainst prorogation in the English High Court. At this level, both courts were at one on this point: the decision of the Prime Minister to prorogue was a classic exercise of prerogative power that was non-justiciable, since it involved matters of high policy and political judgment (see the Miller justifications at paras. 38, 42 and 60, the dicta of Lord Doherty in Cherry 1 at paras. 25 and 26 and the Scottish case law of MacCormcick v Lord Advocate 1953 SC 390, Gibson v Lord Advocate 1975 SC 136 and Lord Gray’s Motion 2000 SC (HL) 46). In their view, there were no legal standards from which to judge the legitimacy of the decision to prorogue (para. 51). The justifications for such an approach are plentiful and eminent. The long line of judicial precedent confirming such an approach stretch from de Freitas v Benny ([1976] AC 239), R v Secretary of State for Foreign and Commonwealth Affairs, ex parte Everett [1975] 1 QB 811 the GCHQ case through to A v Secretary of State for the Home Department [2005] 1 AC 68 (aka the Belmarsh case) and the case of Shergill v Khaira [2014] UKSC 33.  In the Belmarsh case, Lord Bingham famously declared that:

“The more purely political (in a broad or narrow sense) a question is, the more appropriate it will be for political resolution and the less likely it is to be an appropriate matter for judicial decision. The smaller, therefore, will be the potential role of the court. It is the function of political and not judicial bodies to resolve political questions.”

Further, as I discussed last week, the dissenting judges in Miller 1offered a stark warning to judges willing to embark on evaluations of matters involving high policy. Lord Reed expressed the view that:

“It is important for courts to understand that the legalisation of political issues is not always constitutionally appropriate, and may be fraught with risk, not least for the judiciary.”

The English High Court heeded such warnings and tersely stated in the first paragraph of its judgmentin Miller 2 that:

“It is not a matter for the courts.”

The non-justiciability argument appeared to have won the day north and south of the border. And further, to the west, beyond the Irish Sea, the High Court of Northern Ireland in Belfast decided not to rule on the prorogation issue at all, in a case brought by Raymond McCord.

Further, the English High Court also considered at the same time that, even if the contested order to prorogue had been reviewable, a number of legitimate and plausible reasons had been put forward by the Prime Minister that supplied sufficient reasoning for the prorogation (para. 51). Primarily, it is entirely normal and expected that a new Prime Minister would desire a Queen’s Speech in order to give legal effect to their policy priorities. Further, in the present instance, even with prorogation, there would still be time to debate and scrutinise Britain’s withdrawal from the EU; there would already be reduced Parliamentary time to scrutinize, given that the prorogation would fall in the middle of the traditional  party conference season when Parliament is recessed; and finally, the previous Parliamentary session had been one of the longest in living memory.

In the face of such insurmountable odds, it appeared that all was lost for the Remain Alliance. The activities of the Prime Minister were beyond legal reproach, even if not beyond political or ethical reproach. And yet...

The original decision of Lord Doherty in the Outer House of the Court of Session in Scotland was immediately appealed against. On Wednesday the 11th of September 2019, the three judges of the Inner House dropped their bombshell unanimous decision – the decision of the Prime Minister to prorogue Parliament was justiciable and upon subsequent forensic examination it had been found wanting.

The Scottish judges did not hold back, using rather forceful language to condemn the events laid before them. Lord Brodie found that the decision to prorogue was an ‘egregious case’ of improper behaviour (para. 91) falling well below the generally accepted standards of behaviour expected of public authorities and figures.

At first glance, the remarkable decision of the Scottish Supreme Court flies in the face of received legal orthodoxy. Proroguing Parliament is a classically political act, thus protected from legal challenge. So how do lawyers, north and south, square this circle?

The answer comes down to one of approach and the classification of the question that came before the courts in the three jurisdictions of the UK. As I discussed earlier, the question of the justiciability of royal prerogative powers is no longer a binary one, ever since the GCHQ case. Now, the test for justiciability rests on the nature of the prerogative power in question. The more legalistic in nature the power is, the easier it is for the courts to assume jurisdiction. Conversely, the more political or non-legal the power, the harder it is for the court to assume jurisdiction over that decision-making power. However, this sliding scale argument just outlined, does not help much in explaining the diametrically opposed judgments north and south of the border. Indeed, on this view, the English and Scottish courts should have been at one.

Legal clarification to this confusing situation may come, ironically some may say, from eminent Sassenach(used here in a non-pejorative sense) legal jurists, Professor Paul Craig and Professor Mark Elliott. Both Professor Craig and Elliott have cogently and eruditely explained the constitutional dilemmas borne out of Boris Johnson’s premiership. From their perspective, for the courts to absolve themselves from adjudicating upon a matter of such momentous proportions would be a gross dereliction of judicial duty (See Professor Craig’s view on this in his blog Prorogation: Three Assumptions of the 9th of September). The dangers to the UK constitution posed by the behaviour of Boris Johnson both necessitate and justify judicial involvement. This situation is such a singular affront to the democratic principles of the UK’s unwritten constitution that a judicial response is both right and necessary (See Professor Craig’s blog Prorogation: Constitutional Principle and Law, Fact and Causation, of the 31st of August).

To provide for no legal redress in this pivotal moment would create a legal vacuum and indirectly give succour and implicit legitimation to the decision of the Prime Minister (see the discussion of these matters by Alan Greene in his blog Miller 2, Non-justiciability and the Danger of Legal Black Holes, available here). For Professor Elliott, the sweeping, blanket refusal of the English High Court to entertain any possible review of the decision to prorogue is legally suspect on two main grounds. First, because the refusal to adjudicate goes against the liberalising tendency of the extant judicial precedence on non-justiciability, which is incrementally lessening the scope and reach of the non-justiciability barrier and, secondly, and in my opinion more forcefully, the judgment in Miller 2 misconstrued the legal question before it (see Professor Elliott’s blog Prorogation and justiciability: Some thoughts ahead of the Cherry/Miller (No. 2) case, available here).

Thus, the argument for intervention can be justified by looking at the questions before the UK courts from a slightly different perspective. The argument runs that the English High Court focussed, incorrectly, on the evaluation of the exercise of the discretionary power to prorogue. From this perspective, the English High Court fixated on the practical aspects of the decision to prorogue, asking itself questions about the justifications offered for the prorogation and the reasonableness of the length of time of the prorogation.  Therefore, the purpose of the judicial review appears to be one of substitution, that is the court is putting itself in the shoes of the Prime Minister and declaring whether it is reasonable for the Prime Minister to have asked for such a long period of prorogation. If that is so, then traditional legal orthodoxy kicks in: courts are not there to be a substitute for a bad decision maker, particularly when that decision is not made according to legal principles or considerations but rather, is a decision based on pure politics. Such decisions, rightly, cannot and should not be subject to supervision and substitution by the courts. The Inner House of the Court of Session chose another path for adjudication.

The Inner House, having reviewed the legal authorities, considered that the prerogative power to prorogue Parliament was justiciable (para. 31). The Court of Session approached the question from first principles of the UK constitution. The Court of Session asked a different question to that of the English High Court, namely does the legal power exist and if so, what are its boundaries? Questions about the scope of legal powers are classic judicial review questions that need resolution. Indeed, the fundamental grundnorm of the UK unwritten constitution is observance of the rule of law.

Lord Drummond Young, at para. 102, summed up this fundamental truth concisely when he said:

“The rule of law requires that any act of the executive, or any other public institution, must be liable to judicial scrutiny to ensure that it is within the scope of the legal power under which it is exercised.”

In applying this principle to the present case, the Scottish court was being asked if the exercise of the prerogative power to prorogue Parliament was being used for a purpose that was objectively outwith its scope (para. 104). This question could be answered by the Scottish court since the UK case-law evidenced a great deal of judicial flexibility in responding to these types of questions (see the case of Pham v Home Secretary [2015] 1 WLR 1591). In answer to this question, given the voluminous redacted information submitted to the court by Her Majesty’s Government, the answer must be yes: the Prime Minister had prorogued Parliament for an improper purpose, namely to stymie Parliamentary debate, oversight and scrutiny of the UK’s withdrawal from the European Union.

Regardless of their view on the justiciability and merits or otherwise of the case, the seriousness of the case, according to the Scottish judges, absolutely required a robust judicial response in any case. The actions of the Prime Minister had been an egregious case where there had been a clear failure to comply with generally accepted standards of behaviour of a public authority (see para. 91). The exceptional seriousness of the case would require the court to act.

It can be argued that the Scottish judges were not engaged in usurping power from Parliament. On the contrary, the Scottish judges, rather than emasculating Parliament, were, by delivering judgment, empowering Parliament.

The finding of the Inner House means that the decision to prorogue Parliament was illegal and as such the Order in Council is of no legal effect, that is the decision is void ab initio. However, given the constitutional significance of the case and its brethren cases in Belfast and London, the Lord President declined to enforce the judgment at once, given that all these judgments were the subject of an appeal to the Supreme Court of the UK. If the Supreme Court were to ultimately follow the dicta of the Inner House, then the judgment in Cherry 2 would be fully enforced and applied at that date.

The outcome of the conjoined appeals at the Supreme Court of the UK on Tuesday the 17th of September is far from certain. The Scottish judgment is a constitutional first: the first time a serving Prime Minister has been found guilty of acting illegally in relation to the proroguing of Parliament.

What is certain is that the 11 justices of the Supreme Court will once again make UK constitutional history after the hearing on Tuesday week.

Barnard & Peers: chapter 27

Photo credit: parliament.uk

Continue reading Prorogation of Parliament: Conflicting judgments in England and Scotland