International Data Transfers: The First Data Protection Case To Reach The Supreme Court

• Published date: 30 September 2020
• Subject Matter: Privacy, Data Protection
• Law Firm: Bortstein Legal Group
• Author: Mr Benjamin Ross

This week one of the longest running data protection sagas concluded. Interestingly, the first major data protection case to reach the UK's Supreme Court did not involve GDPR, but the Data Protection Act 2018 (DPA 2018). It demonstrated that the applicability of the DPA 2018 had not been understood by the very body which had drafted it. The case concerned the notorious so-called ISIS Beatles (on account of their British accents), who were alleged to have kidnapped and murdered 27 people of which three were Americans and two were British.

The case is interesting for a number of reasons as follows:

1. It reveals the pervasive nature of data protection legislation as it impacts all areas of law and data sharing.
2. It shows that the ignorance of data protection issues can be much wider that might be expected. One would have assumed that the body which actually passed the legislation, aka the British government, may have considered its impact when making critical decisions.
3. Most importantly, the case demonstrates that the UK courts will demand rigorous adherence to data protection legislation. While this case concerns Part 3 of the DPA 2018 (which applies to law enforcement processing), companies must still take scrupulous care in relation to international data sharing and indeed with compliance with data protection legislation in general.

The American government, having captured the ISIS Beatles in Syria, requested that the UK government share the evidence which had been obtained investigating their crimes. But the American government demanded, almost uniquely, that the evidence be shared without any restrictions. Normally it is the case that if the UK government shares evidence there will be an assurance provided that no death penalty be...