Debate: Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems  - Case C- - The adequate protection of personal data by the United Kingdom
Date: THURSDAY, 20 MAY 2021
Speaker: Didier Reynders
Language: EN

In EU law, as in UK law, data protection rights just like many other fundamental rights are not absolute. They can be balanced against all the objectives of public interest. Article 23 of the GDPR allows EU Member States to introduce exceptions to the data protection rights if they are necessary and proportionate for important objectives of general public interest. It is under that provision that the UK immigration exemption was introduced while the UK was still a Member State. Effective immigration control is an important objective of general interest. According to UK law, this exemption can be relied on, on a case-by-case basis, only if at a certain moment in time, the application of certain data protection provisions can prejudice, the maintenance of effective immigration control. It is also important to recall that the scope of this exemption is limited to certain rights and obligations. For instance, the right to rectification is not a right which can be restricted under this exemption. Like any other provision of UK data protection law, the use of this exemption can be challenged by the concerned individuals before the Data Protection Authority and courts. We have not limited our assessment of this exemption to what is written in the law. We have also looked at how it has been interpreted and applied. Both UK courts and the UK Data Protection Authority confirmed that this exemption is subject to the strict requirements of necessity and of proportionality, which prevent it to be used in a generalised or abusive manner. In particular, while the UK was still an EU Member State, the UK High Court assessed whether the immigration exemption was in line with the requirements of the GDPR and the charter, and it came to the conclusion that this is the case. More specifically, the High Court concluded that the exemption can only be invoked in a specific case if otherwise there would be a very significant and ready chance of prejudice to the public interest at stake in this specific case. This is clearly a high standard developed by consolidated case law in the UK. It means in particular that a mere impact on immigration control is not sufficient to rely on the exemption. Moreover, the UK Data Protection Authority has assured detailed guidance for the use of the immigration exemption, making clear that it cannot be used in a blanket manner and that it must be carefully considered and the documented in each and every case. It is difficult to understand why such a provision that has not been changed since the UK left the EU would now need to be considered as not meeting the test of essential equivalence. The UK authorities have also shared some figures on how these limitations on the use of this exemption are reflected in practice. For example, the exemption was never applied in the context of the issuance of so-called settled status to more than 4 million EU citizens who were residing in the UK before the end of the transition period. When considering all immigration cases concerning European Economic Area citizens, the cases in which the exception was used in 2020 amount to 2.8 percent of such cases.  That doesn’t mean that the situation can never change. We of course recognise the importance of this issue, that goes to the very heart of EU citizen rights when they travel to work or reside in the UK. And this is why following EDPB opinions and exchanges in the Committee on Civil Liberties, Justice and Home Affairs (LIBE Committee), we have specifically strengthened the monitoring clause of our draft decisions in that respect.  The application of the immigration exemption and its impact on the effective exercise of individual rights in the UK is expressly identified as one of the areas that we will monitor very closely and an area where a lowering of protection would lead to launching the suspension or termination or amendment to our schedule. Madame la Présidente, Mesdames et Messieurs les députés, je crois que nous avons vraiment tenu à vérifier non seulement la situation légale en Grande-Bretagne, mais aussi la manière dont ces textes sont interprétés et appliqués – je viens d’en donner un exemple. Cependant, il ne fait aucun doute que les données personnelles des citoyens européens doivent être protégées de manière adéquate lorsqu’elles sont transférées en dehors de l’Union européenne. L’arrêt Schrems II de la Cour européenne de justice rappelle les défis auxquels nous sommes confrontés pour garantir la protection des droits fondamentaux dans un monde numérique interconnecté et sans frontières, où un transfert de données peut avoir lieu en un seul clic.  Les entreprises doivent pouvoir s’appuyer sur des mécanismes de transfert solides, juridiquement sûrs et prévisibles. C’est ce à quoi les entreprises européennes s’attendent à juste titre, car elles sont amenées à transférer des données non seulement vers le Royaume-Uni ou les États-Unis, mais également vers de nombreuses autres destinations dans le monde, dans le cadre de leurs opérations quotidiennes. C’est en travaillant avec des partenaires internationaux ayant des approches similaires que l’Union peut être en mesure de façonner les règles du jeu au niveau global. Ceci est encore plus important lorsque d’autres acteurs internationaux avancent un agenda différent, basé sur des valeurs fondamentalement différentes des nôtres. En ce qui concerne plus spécifiquement les décisions d’adéquation avec le Royaume-Uni, je pense que notre approche doit s’inspirer de celle suivie avec succès par mon ancien collègue, Michel Barnier, lors des négociations relatives au Brexit: à la fois calme et objective, préparée à tous les scénarios possibles et déterminée à défendre les valeurs et principes de l’Union avec la plus grande fermeté.