A Powerful Lesson In UK Data Protection Law Restrictions

• Published date: 06 June 2020
• Author: Mr David Rundle
• Subject Matter: Privacy, Privacy Protection
• Law Firm: WilmerHale

The protections afforded by the GDPR and the UK's 2018 Data Protection Act ('DPA') are not naturally associated with efforts to frustrate and restrict the use of the death penalty internationally. However, the recent Supreme Court judgment, Elgizouli v. Secretary of State for the Home Department [2020] UKSC 10, exemplifies how data protection law may have far wider effects than one would naturally anticipate. The case concerns the UK Government's decision to provide mutual legal assistance to the United States in connection with a US investigation into Shafee el Sheikh, the Appellant's son, suspected of committing various atrocities as an ISIS militant. Some of those offences carried the death penalty. Breaking with its customary protocol, the UK Government transferred material to the US without obtaining assurances that he would not be subject to the death penalty.

The appeal (from the Divisional Court) was brought on two separate grounds. First, that there existed a common law that the Government would not provide any mutual legal assistance which risked leading to the use of the death penalty.¹ Second, that the UK Government's decision to provide the information was unlawful under the DPA, specifically Part 3 which relates to the processing of data in the context of law enforcement.

Ultimately the Appellant was unsuccessful on the first ground. The majority view of the Court (Lord Kerr dissenting) was that the common law prohibition had not yet developed to encompass all assistance. However, the Court held unanimously for the Appellant on the second ground, finding that the Home Secretary had failed to meet the required conditions under the DPA, on which any transfer had to be predicated. The decision unequivocally emphasises the significance of the procedural requirements under the DPA, specifically the need for any transfer to be preceded by a conscious and contemporaneous assessment of how the transfer meets each element of the statutory framework. To that extent, it has implications not only for state authorities seeking to transfer data to their international counterparts, but also for private data controls generally, particularly in the context of investigations.

Background to the Home Secretary's decision

El Sheikh is accused of membership of a group of British Isis militants known as 'the Beatles', responsible for the brutal murder of a number of western hostages. El Sheikh was a British national, but in 2014 he had been stripped of his...