THE QUEEN on the application of OPEN RIGHTS GROUP (2) THE3MILLION v (1) SECRETARY OF STATE FOR THE HOME DEPARTMENT (2) SECRETARY OF STATE FOR DIGITAL, CULTURE, MEDIA AND SPORT [2021] EWCA Civ 1573

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT
Mr Justice Supperstone
[2021] EWCA Civ 1573Case No Case No: C1/2019/2726Venue Royal Courts of Justice, Strand, London, WC2A 2LL
Between
THE QUEEN on the application of OPEN RIGHTS GROUP (2) THE3MILLIONClaimants/Appellants(1) SECRETARY OF STATE FOR THE HOME DEPARTMENT (2) SECRETARY OF STATE FOR DIGITAL, CULTURE, MEDIA AND SPORTDefendants/Respondents(1) LIBERTY (2) INFORMATION COMMISSIONERInterveners
Before
Lord Justice UnderhillLord Justice SinghLord Justice WarbyBen Jaffey QC, Julianne Kerr Morrison and Nikolaus Grubeck (instructed by Leigh Day) for the AppellantsSir James Eadie QC and Tristan Jones (instructed by the Treasury Solicitor) for the RespondentsThe First Intervener was not representedChristopher Knight (instructed by ICO) for the Second IntervenerHearing date: 8 October 2021Date 29 October 2021

LORD JUSTICE WARBY:

On

[1]26 May 2021, we allowed this appeal, holding that the "Immigration Exemption" contained in paragraph 4 of Schedule 2 to the Data Protection Act 2018 is contrary to Article 23 of the GDPR and Article 23 of the UK GDPR: [2021] EWCA Civ 800 , [2021] 1 WLR 3611 ("the Main Judgment"). We did not at that stage decide what form of relief should be granted.[2]The claim form seeks a declaratory order, the effect of which would be to "disapply" the Immigration Exemption. But by the end of the appeal hearing it had become common ground that the issue of relief raised some sensitive and complex issues, and would need to be the subject of separate argument. So, we decided to defer a decision on that issue, inviting further submissions in the light of our reasons: see the Main Judgment [55-58].[3]One possibility recognised by the Court and the parties was that relief might be suspended for a period of time to allow the Government to devise and implement a legislative remedy for the deficiency we had identified. Authority for such a form of remedy can be found in the decision of the Divisional Court in R (National Council for Civil Liberties) v Secretary of State for the Home Department and another [2018] EWHC 975 (Admin) , [2019] QB 481 ( "Liberty") and in the jurisprudence of the CJEU, which contemplates the temporary suspension of the ousting effect of a rule of EU law: see La Quadrature du Net and others (Cases C-511/18, C-512/18 and C-520/18) [2021] 1 CMLR 31 ( "La Quadrature" ).[4]We gave directions for a further hearing, with sequential service of evidence and written submissions in the meantime. The main issues for our decision are:(1) whether we have jurisdiction to suspend relief for a period of time and, if so(2) whether and, if so, to what extent and for how long we should exercise it.[5]The written submissions of the parties, and of the second intervener, the Information Commissioner ("ICO"), can be summarised as follows.[6]The Respondents' submission is that we should not grant relief disapplying the Immigration Exemption forthwith. That is unnecessary and would have a number of undesirable consequences. Instead, the Respondents should be granted a period of grace, in accordance with the principles identified in Liberty and La Quadrature. The Respondents' proposal is to remedy the position by exercising the power conferred on the Second Respondent by s 16(1) of the DPA 2018, to make regulations adding to or varying the provisions of Schedule 2. It is not controversial before us that this is, in principle, a legitimate mechanism by which to amend the law. Indeed, the submissions for the ICO had drawn attention to this power: see the Main Judgment at [54]. But the power is subject to the affirmative resolution procedure: s 16(3). And it is said that time is required to go through all the necessary steps. The form of relief proposed was a declaration that:(a) for the reasons explained in the Court's Judgment, the Immigration Exemption is incompatible with Article 23 UK GDPR, and(b) the incompatibility must be remedied within a reasonable time, by laying an appropriate statutory instrument before Parliament by 31 January 2022.[7]The Appellants agree that, in the light of Liberty and La Quadrature, it is permissible in a case of this kind to withhold immediate relief. But it is submitted that the power is narrow and circumscribed. Any alternative form of relief must be exceptional, temporary, and justified by overriding public interest considerations relating to a genuine and serious threat of interruption or harm to the public interest. The relief must also respect the essence of the right at issue. The Respondents' evidence falls far short of demonstrating that these conditions are satisfied. Any exception to the relief we grant should be limited in scope and in time. It would be wrong in principle to tie the end point to the laying of a draft Statutory Instrument. The Appellants' position, in written submissions, was that the Respondents should be given until 30 November 202l to bring new legislation into effect.[8]The ICO also agrees that the Court has power to grant relief of the kind proposed by the Respondents. Unsurprisingly, the ICO has raised no queries about the proposed methodology. It is submitted that in framing a suspended order we should seek to strike an appropriate balance between the relevant considerations of legal certainty, bearing in mind that the suspension of a remedy otherwise due is an exceptional course which must be properly justified and permitted only for a period which is strictly necessary. According to the ICO, an appropriate outcome would be to make an unqualified declaration of incompatibility, and an unqualified order suspending its effect until a reasonable, specified date. The date identified by the ICO is 31 December 2021.[9]In their written reply, the Respondents contended that if the Court imposes a final deadline then the dates suggested by the Appellants and the ICO were too early. If the Court imposed a final deadline for the law to come into force, the backstop date for this should be 21 April 2022.[10]By the time of the remedies hearing on Friday 8 October 2021, the issues had narrowed. Counsel were unanimous that, post-Brexit, the court can allow the Government time to correct and deal with an incompatibility of the kind that we have found. The Respondents' position on timing had shifted. They were now content to be given until 31 January 2022 to procure a change in the law, with liberty to apply for more time in the event of unexpected circumstances. Once this was made clear in oral submissions for the Respondent, the Appellants indicated in reply that this was acceptable. The only remaining issue as to scope was whether, as contended by the Appellants, the suspension should benefit only public authorities, with no suspension so far as the private sector was concerned. The Respondents, with the support of the ICO, resisted any such limitation.[11]The parties' partial agreement does not of course absolve us of the duty to make decisions on all the issues, which are not only matters of importance to those involved in and affected by this case; they also have wider significance. We had the benefit of detailed oral argument, to the excellence of which I would like to pay tribute.[12]At the end of the hearing, we had reached a clear conclusion. Given the importance to the parties of knowing the outcome promptly, we announced that we would make an order containing a declaration reflecting the Main Judgment, but suspending its effect entirely until 31 January 2022; the parties would have liberty to apply in relation to the duration of the suspension. We reserved our decision on the precise form of order, and our reasons. This judgment contains my reasons for joining in that decision and identifies the form of order that I consider appropriate. The first issue: is there jurisdiction to suspend relief?[13]This is a question of English law, but we have only been addressed on the part of English law that consists of retained EU law. That is the legal basis for our decision. This judgment should not be read as having any wider effect.[14]As explained in the Main Judgment at [12-13], the GDPR no longer has direct effect as EU legislation; it has been absorbed into English law as the UK GDPR. But it retains the supremacy over other domestic instruments that it enjoyed in its capacity as an EU Regulation. That means that any conflict between the GDPR and domestic legislation (including primary legislation) must be resolved in favour of the former: the domestic legislation must be overridden, treated as invalid or, in the conventional language, disapplied. That is the sole basis on which we were able to conclude that Article 23 invalidated primary legislation in the form of the Immigration Exemption.[15]That said, the supremacy of the UK GDPR within our post-Brexit domestic legal order does not make it constitutionally proper for an English Court to make a quashing order in respect of primary legislation. This was not an available remedy when the UK was a Member State; but the court could and where appropriate did make a declaratory judgment or[16]In R (Chester) v Secretary of State for Justice [2013] UKSC 63 , [2014] AC 271 [72-74], Lord Mance JSC addressed the question in the context of a claim that the domestic statutes abrogating voting rights for prisoners were inconsistent with EU Law. [1] The Supreme Court held that there was no inconsistency, but Lord Mance went on to consider, obiter , what relief would have followed if the decision had gone the other way. At [73], he rejected the submission that the Supreme Court "should simply disapply the whole of the legislative prohibition on prisoner voting … thereby making all convicted prisoners eligible to vote pending fresh legislation found to conform with European law." At [74], he pointed out that an alternative scheme that removed voting rights for some but not all convicted individuals might pass muster, and the Court was not equipped to devise such a scheme or to determine or implement the necessary practical or administrative arrangements. All of that had to be left to Parliament.[17]In Liberty it was necessary to address head on the issue of whether relief must be immediate. This was a decision of a Divisional Court, before the European Union (Withdrawal) Act 2018 ("EUWA") had been passed, and well before the consequent repeal of the European Communities Act 1972. In judicial review proceedings following the decisions of the CJEU in Watson [2017] QB 771 it was established that Part 4 of the Investigatory Powers Act 2016 was inconsistent with EU law (the e-Privacy Directive, 2002/58) in so far as it allowed access to retained communications data in the area of criminal justice without limiting this to the purpose of combating "serious crime", and without the safeguard of prior review by a court or independent administrative body. Communications data retained under these provisions had been central to the investigation and prosecution of crime. An order disapplying Part 4 with immediate effect would thus have had dramatic consequences for the public interest. That, it was submitted, would be "a recipe for chaos". The Court (Singh LJ and Holgate J) considered whether that was the only available relief, or whether it could and should make a declaration disapplying Part 4, suspended to allow time for the introduction of compatible legislation. The Court concluded that the latter course was both available and appropriate. It held the legislation must be amended within a reasonable time, which was specified as 1 November 2018, just over six months from the date of its judgment. It granted a declaration to that effect.[18]The Court regarded Chester as demonstrating that there was no automatic rule that national legislation must be immediately disapplied, once it is held or conceded that it is incompatible with EU law. What is crucial is the nature of the incompatibility. In Liberty, the deficiency was a want of appropriate safeguards. Thus, as in Chester, it was not inevitable that the entire legislative scheme must be disapplied and discarded for good. On the contrary, there clearly would be a need for an alternative scheme. The Court observed ([75]) that in those circumstances it was "unable to reach the view that, from the moment when the incompatibility was pronounced by the CJEU or when it was acknowledged by the Home Secretary the national legislation had as a matter of absolute obligation to be disapplied immediately" and held as follows:
"76. … the appropriate and principled approach is for the court to allow both the Government and Parliament a reasonable amount of time in which they have the opportunity to enact national legislation to correct the defects which exist and which are incompatible with EU law. …. 85. … there are strong constitutional reasons, and not only practical ones, for declining to grant any order or declaration which would have the effect of immediately disapplying the provisions of Part 4 of the 2016 Act."
[19]The question of whether relief for inconsistency can be suspended has been addressed by the Grand Chamber of the CJEU itself in three decisions since the judgment in Liberty : La Quadrature, A v Gewestelijke Stedenbouwkundige Ambtenaar van het Department ruimte Vlaanderen (Case C-24/19) [2021] CMLR 9 ("Gewestelijke"), and B v Latvijas Republikas Saeima Case C-439/19, EU-C-2021-504 (" B v Latvia" ).[20]In La Quadrature , the CJEU was concerned with national legislation requiring what it referred to as "the general and indiscriminate retention of traffic and location data," contrary to the e-Privacy Directive and the Charter. The Belgian Court asked whether a national court could, with a view to pursuing the objectives of national security and combating crime, "limit the temporal effects of a declaration of illegality" in respect of such domestic legislation. Addressing this question at [213-228], the CJEU underlined the importance of the principle of primacy of EU law. It held nonetheless that, in accordance with its earlier jurisprudence, it was open to a national court to maintain the effect of a national measure that violated a procedural obligation under EU law, such as the requirement to conduct an environmental impact assessment ("EIA"), if the maintenance of the domestic provision was "justified by overriding considerations relating to the need to nullify a genuine and serious threat of interruption in the electricity supply in the Member State concerned". The Court held, further, that the overriding or ousting effect of a rule of EU law could also be suspended temporarily in respect of a substantive legal measure, but only in exceptional cases, on the basis of overriding considerations of legal certainty ([216]), and only by the CJEU itself. On this last point the Court reasoned, at [217] that:
"The primacy and uniform application of EU law would be undermined if national courts had the power to give provisions of national law primacy in relation to EU law contravened by those provisions, even temporarily."
[21]Gewestelijke was a case about planning consent for a wind farm development in Belgium. Local residents claimed an order annulling the consent on the basis that the failure of Belgian domestic law to provide for an EIA was a breach of Directive 2001/42/EU. The national court stayed the proceedings and asked the CJEU, among other things, what the legal impact on the consent would be if the claimants were right. The central issue was whether, in that case, the domestic legal order could be maintained for a period of time. The Court reiterated, at [84], [90] and [92], the principles identified above. At [94] it added that in any event the maintenance of the domestic legal measure "may last only as long as is strictly necessary to remedy the breach found". It was for the national court to determine whether the relevant tests were satisfied on the facts of the case.[22]B v Latvia was concerned with a provision of domestic law that provided for unrestricted public access to information about the penalty points imposed on individuals for driving offences. The national court referred four questions to the CJEU. The first three asked whether the regime offended the GDPR. The Court held that it did. The fourth question was whether, in that event, the primacy principle precluded the national court from deciding that, for reasons of legal certainty, the legal effects of the regime should be maintained until the date of the national court's final judgment. The Court held that, on the facts of the case, it did. The applicable principles were re-stated as follows (internal citations are omitted):
"132 … the interpretation which, in the exercise of the jurisdiction conferred on it by Article 267 TFEU, the Court gives to rules of EU law clarifies and defines the meaning and scope of those rules as they must be or ought to have been understood and applied from the time of their entry into force. It is only exceptionally that the Court may, in application of the general principle of legal certainty inherent in the EU legal order, be moved to restrict for any person concerned the opportunity of relying on a provision which it has interpreted with a view to calling into question legal relationships established in good faith. Two essential criteria must be fulfilled before such a limitation can be imposed, namely that those concerned should have acted in good faith and that there should be a risk of serious difficulties. … 135. By virtue of the principle of primacy of EU law, rules of national law, even of a constitutional order, cannot be allowed to undermine the unity and effectiveness of EU law … Even assuming that overriding considerations of legal certainty are capable of leading, by way of exception, to a provisional suspension of the ousting effect which a directly applicable rule of EU law has on national law that is contrary thereto, the conditions of such a suspension can be determined solely by the Court …"
[23]The status of these CJEU decisions post-Brexit is clear enough. Parliament has made detailed provision about the matter, in s 6 of EUWA and in The European Union (Withdrawal) Act 2018 (Relevant Court) (Retained EU Case Law) Regulations 2020, SI 2020 No 1525 ("the Regulations"). For present purposes, the key points can be summarised in this way.(1) A UK court must now decide any question as to the validity, meaning or effect of any retained EU law for itself: it is no longer possible to refer any matter to the CJEU: EUWA s 6(1)(b).(2) But the general rule is that the court must decide any such question in accordance with any retained case law and any retained general principles of EU law that are relevant: EUWA s 6(3). "Retained EU case law" and "retained general principles" mean principles laid down and decisions made by the CJEU before IP completion day.(3) When it comes to principles laid down or decisions made by the CJEU after IP completion day, the court is not bound (EUWA s 6(1)) but "may have regard" to them (EUWA s 6(2)).(4) The position is different in a "relevant court", which includes the Court of Appeal. Subject to an exception that does not apply here, a relevant court is not absolutely bound by any retained EU case law: EUWA s 6(4)(ba) and Regulations 1 and 4. It can depart from that law; but the test to be applied in deciding whether to do so is "the same test as the Supreme Court would apply in deciding whether to depart from the case law of the Supreme Court": EUWA 6(5A)(c) and Regulation 5.(5) The test the Supreme Court applies is the one laid down by the House of Lords in its Practice Statement [1966] 1 WLR 1234, when Lord Gardiner LC said this:
"Their Lordships regard the use of precedent as an indispensable foundation upon which to decide what is the law and its application to individual cases. It provides at least some degree of certainty upon which individuals can rely in the conduct of their affairs, as well as a basis for orderly development of legal rules. Their Lordships nevertheless recognise that too rigid adherence to precedent may lead to injustice in a particular case and also unduly restrict the proper development of the law. They propose, therefore, to modify their present practice and, while treating former decisions of this House as normally binding, to depart from a previous decision when it appears right to do so. In this connection they will bear in mind the danger of disturbing retrospectively the basis on which contracts, settlements of property and fiscal arrangements have been entered into and also the especial need for certainty as to the criminal law. This announcement is not intended to affect the use of precedent elsewhere than in this House."
[24]La Quadrature and Gewestelijke were decided before IP completion day. We are not absolutely bound by them, but we should decide this case in accordance with the principles they set out, unless we think it right to depart from those cases for the reasons set out by Lord Gardiner. B v Latvia was decided after IP completion day, so we can "have regard" to it.[25]So much for the status of these cases as authority. The more difficult question is how they should be applied in a jurisdiction over which the CJEU no longer has any authority. This might not be a particularly difficult issue if we were persuaded by the Respondents' argument that the retained law that falls to be "disapplied" in this case falls into the category of "procedural" measures. The case law is clear: the effect of such measures can properly be suspended by a national court, albeit in limited circumstances. But I do not consider that line of reasoning is properly open to us. The Immigration Exemption is not a departure from some merely procedural regime. It plainly involves a derogation from fundamental rights to data privacy and data protection. So we have to confront the question of what rule should be applied where domestic legislation is inconsistent with a substantive provision of retained EU law.[26]There appear to be three main options available to us. One is to hold that since the power to suspend relief in respect of substantive laws that is identified in La Quadrature and Gewestelijke is one that can only be exercised by the CJEU, it cannot be exercised at all in this jurisdiction. An alternative would be what one might call "the Regulation 5 approach": to apply the principles laid down in the 1966 Practice Statement and depart from the CJEU case-law, holding that the power which, in that jurisprudence, is reserved to the CJEU should now be treated as available to at least some UK Courts. A third option is the one principally contended for by the parties and the ICO in this case: to follow and apply the CJEU jurisprudence as to the existence and limits of the power to suspend, but not that aspect of the case-law that reserves the exercise of that power to the European Court.[27]I would reject the first option. This would be an unduly mechanistic and literal approach, tending to subvert rather than promote the legal policy that underlies this aspect of the CJEU jurisprudence. It seems to me that when it comes to the issue of suspending substantive EU law the ratio decidendi of La Quadrature and the other cases cited has two distinct elements. These may be summarised as follows:(1) where a subsidiary rule of (national) law is inconsistent with a dominant rule of (EU) law and must therefore be overridden, there must be a judicial power to delay the implementation of the dominant rule, where that is necessary for compelling reasons of legal certainty; but(2) in the interests of legal certainty, that judicial power must be reserved to the CJEU. This way of putting it highlights the fact that the imperative that underlies each element of the ratio is the same: the preservation of legal certainty. A slavishly literal application of the second element of the ratio would defeat the first. This would undermine the law by removing from the judicial armoury a power that is, by definition, essential. Such an outcome would be paradoxical and, in my judgment, plainly wrong.[28]To avoid that outcome I would, if necessary, adopt the Regulation 5 approach, and depart from this second element of the CJEU jurisprudence. The aim of doing so would be to retain the crucial first element, and thus enable a court to perform one of its essential tasks: averting legal disorder. This would not represent a departure from precedent that would disturb settled expectations of the kinds referred to by Lord Gardiner. But, in my view, that course is not in truth necessary. For my part, I think the same result can be achieved in a more satisfactory way, if we recognise that the second element of the CJEU jurisprudence is simply incapable of direct transposition into the domestic legal order as it now stands.[29]Within the scheme of EU law, the CJEU is supreme. To ensure the law is interpreted and applied uniformly across the Union, questions of EU law that are unclear are not decided by national courts but referred to the CJEU for authoritative resolution. Today, the CJEU holds no sway in English law. It is not possible to refer a question of retained EU law to Luxembourg. But the matter goes further than that. The EU structure has no analogue within our domestic system of courts and tribunals. We have different means of ensuring the uniform and consistent interpretation and application of the law. In our system, as a rule, courts and tribunals at all levels are duty bound to decide legal issues on which there is no precedent that binds them. Our Supreme Court is a final court of appeal, not a court to which inferior courts and tribunals refer a question without first deciding it. In such a system, there is no need nor any reason to adopt the principle that reserves the power to suspend to the supreme judicial authority. Indeed, it seems to me that the second element of the CJEU decisions is incapable of application here. On this analysis, there is no question of departing from retained EU law; the principle in question has not been retained because it cannot be translated. And on this analysis any first instance court or tribunal can, in principle, suspend relief.[30]There would also be a logical symmetry if this approach is adopted. The issue of potential disapplication of legislation, even primary legislation, because it is incompatible with EU law may arise in any court or tribunal. Such issues have arisen in the past, for example in employment tribunals. Now that such lower courts and tribunals cannot make a reference to the CJEU, it would make sense if they could in principle exercise the power of suspension (in suitable cases) rather than having to disapply the legislation with immediate effect.[31]For these reasons, I would hold that this Court has the power identified in the CJEU jurisprudence: to delay or suspend the implementation of a dominant rule of (retained) EU law, and the consequent disapplication of an inconsistent domestic provision. My preferred route to that conclusion is the third of the options identified above. But because I think that either of the two routes just discussed is available to us it is not necessary to reach a definitive conclusion on the matter, and I think it better not to do so.[32]The circumstances in which this power can be exercised, and its limits or parameters, are indicated in CJEU jurisprudence which can be transposed into domestic law without difficulty and from which I see no need or reason to depart. La Quadrature makes clear that the power is limited to permitting a temporary suspension, and should be exercised only exceptionally, on the basis of "overriding considerations of legal certainty". Put another way the interests of legal certainty must be so compelling that it is necessary for them to take priority over the need to implement the dominant legal provision, and disapply the subordinate law. The strictness of this test reflects the key point, that any suspension represents a disapplication of legal rights which the legislature has conferred on natural or legal persons.[33]It follows that not only the decision to suspend but also the duration of any suspension needs clear justification. As the Divisional Court observed in Liberty [93]:
"it would not be just or appropriate for the Court simply to give the Executive a carte blanche to take as long as it likes in order to secure compliance with EU law. The continuing incompatibility … needs to be remedied within a reasonable time."
Gewestelijke elaborates on this point. It emphasises the need to minimise the interference with the normal order of things by ensuring that any suspension lasts no longer than is "strictly necessary". I take this to mean that, in a case such as this one, it is not enough that the government would find it convenient to have more time, or that the period sought would be reasonable from an administrative point of view. The court must be satisfied that the period of suspension imposed is really needed, to avoid legal uncertainty. B v Latvia adds two criteria which are persuasive and which I would accept: that it must be shown that the party concerned (here, the Government) has acted in good faith and that immediate disapplication would cause "serious difficulties". The second issue: how, if at all, should the jurisdiction be exercised?[34]There is no doubt as to the good faith of the Respondents. We were satisfied that the other criteria I have listed were met in this case. My reasons are these.[35]As Sir James Eadie submitted, there is nothing in the UK GDPR that precludes the use of a legislative exemption serving the same purpose as the Immigration Exemption. We have held that the exemption is an unauthorised derogation from the UK GDPR because it does not contain specific provisions corresponding with the mandatory requirements of Article 23(2), and therefore omits the necessary substantive and procedural safeguards. This is therefore a case akin to Chester and Liberty, where the reality is that the legislative scheme needs reconstruction not complete demolition.[36]I would accept that it is likely that a regime can be devised that serves at least some of the purposes of the Immigration Exemption but does contain the safeguards required by Article 23(2). I accept also that the Respondents' aim is to devise and implement such a regime. It is obvious that this process is bound to take some time. It requires careful thought at the policy level, legal input, and Parliamentary time.[37]If we made an order with immediate effect the law as declared by us would not be the law as stated on the face of the DPA 2018. It would be highly undesirable, in my view, for such a disconnect to exist at all, or for more than a very short period. The rights conferred by the DPA are important rights. Compelling considerations of legal certainty support a suspension, so that the law as written on the statute book complies with the law as declared in the case law.[38]Immediate disapplication of the Immigration Exemption would, as the Appellants concede, cause serious practical difficulties at least in the short term. The evidence demonstrates that the Immigration Exemption has been and still is extensively relied on by the Home Office: see the Main Judgment at [16-17]. The circumstances that give rise to reliance on this exemption may on occasion, perhaps very often, entitle the respondents to rely on other exemptions; there may well be overlaps of this kind. But to require the Respondents to review cases without regard to the Immigration Exemption would be hugely disruptive. In my judgment, the extent and significance of such disruption lends convincing support to the case for overriding, for a period of time, the substantive rights at issue.[39]It is obvious, also, that the reasoning of the Main Judgment could have implications for other exemptions provided for in Schedule 2 to the DPA 2018. It is eminently desirable in the interests of legal certainty that the respondents should have time to consider whether any and if so what amendments may be needed to other provisions.[40]All of these factors point strongly to a real need for a suspension of some kind, for some period of time. I consider they amount to the kind of overriding considerations referred to by the CJEU. That brings me to the questions of the duration and scope of the suspension. How long?[41]We know that Government is able to formulate policy and implement it via wide-ranging and detailed statutory instruments at speed, where necessary. If there were ever doubt about that, the experience of recent years has demonstrated it very clearly. The need to devise a reconstituted scheme of exemption to replace Schedule 2 of the DPA 2018 falls far short of an emergency on the scale of the Covid-19 pandemic. But it is clear law that the Government must show that the temporary continuation of an inconsistent law is really needed in the interests of legal certainty. The whole period of delay that is proposed must be justified to that standard. Against that background of principle the respondents' initial approach was, in my judgment, far too relaxed. Indeed, the very fact that they have managed to amend their proposals so significantly could be thought to demonstrate as much.[42]The Respondents' eventual concessions make it unnecessary to go into fine detail about the background and the pros and cons of their earlier proposals. It is worth noting a few points, nonetheless. First, the chronology. The Main Judgment was handed down on 26 May 2021. On 30 June 2021, the Respondents filed written submissions on relief and the first witness statement of Christophe Prince, Director of the Data and Identity Directorate in the Home Office. On 21 and 23 July 2021, the Appellants filed their written submissions, accompanied by the witness statement of Sahdya Darr. The submissions of the intervener, the ICO followed on 20 August 2021, and on 3 September 2021, the Respondents filed written reply submissions. These were accompanied by a second witness statement of Mr Prince.[43]The Respondents' evidence identified the need for an elaborate process involving, by my count, no fewer than 12 separate stages, each requiring its own time slot. By early September, over 3 months after our judgment, little of this had been accomplished. The Respondents had got as far as sending instructions to statutory drafting lawyers. The timetable then proposed would not have yielded up a draft statutory instrument before the end of January 2022, and no guarantee was being offered as to when the legislation would be in place. Of course, the Parliamentary process involves many competing priorities, all jostling for a position at the head of the queue. But the argument that the respondents were not in control of the process was unconvincing, given that in our system the Government has practical control over the Parliamentary timetable. As Mr Prince observed, there were Parliamentary recesses in September and November 2021. But these were of limited relevance, when the process was progressing so slowly. The long-stop of April 2022 that was rather grudgingly put forward would have given the Respondents the best part of 11 months from the date of judgment.[44]I would not have been persuaded that this relatively leisurely pace was compatible with the requirement of "strict necessity" identified in the authorities. It would have stood in stark contrast to the position in Liberty , where the task to be undertaken included the creation of an entirely new public body, and the period allowed was little over 6 months.[45]The Respondents had evidently anticipated that this might well be the view of the Court. In his closing submissions Sir James Eadie identified four main steps that remained to be carried out, and gave estimates of the time needed to complete them. These were:(1) Finalisation of the draft statutory instrument, involving submission to the Office of Parliamentary Counsel, and a period for reflection; this was said to need 3 weeks;(2) statutory consultation with the ICO pursuant s 182(2) of the DPA 2018, which was said to require 7 to 10 days;(3) first Parliamentary stage, involving scrutiny of the draft by the Joint Committee on Statutory Instruments ("JCSI"), an essential feature of the affirmative resolution procedure; the estimate for that was a further 2-3 weeks;(4) the formal Parliamentary processes, by which the SI would be laid, scrutinised again by the JCSI, and then presented to both Houses; this process, including any debate, would usually take some 6-8 weeks. The proposal was to lay an SI in mid-December, with the law coming into effect at the end of January 2022.[46]I suspect that if the Respondents had acted with a greater sense of urgency in the wake of the Main Judgment, this could all have been accomplished sooner than that. But it must be acknowledged that this is a greatly compressed timetable, when compared with the Respondents' initial proposal. Ultimately, I find this new case on timing sufficiently convincing. I agree with Mr Jaffey for the Appellants and Mr Knight for the ICO that the period of suspension ultimately proposed is a justifiable one. Complete or partial suspension?[47]The remaining issue is a narrow but significant one. The Appellants and the ICO accept, and I agree, that a compelling case has been made out for suspending the impact of our decision on the public sector until the end of January 2022. Mr Jaffey argues, however, that there should be no such suspension so far as the private sector is concerned, because the evidence and argument placed before us do not show that the standard of strict necessity is met in that respect. This approach is resisted by the Respondents, supported in this respect by the ICO.[48]It is true that we have little if any evidence that is clearly directed to the question of how the wholesale disapplication of the Immigration Exemption would affect private sector operations. But I do not agree with the Appellants' submission, for five main reasons.[49]First, although in formal terms the Respondents bear the burden of persuading us of the need for a suspension I am not so sure they bear the legal burden of demonstrating that suspension must be wholesale, across the board. The issue does not appear to be addressed anywhere in the authorities. I feel some disquiet about discriminating between the public and private sectors in the way suggested by the Appellants, without an evidential foundation.[50]Secondly, and in any event, I am not convinced that the Respondents need to adduce evidence. We know that in the area of immigration control Parliament has progressively imposed significant legal responsibilities on private sector actors, such as employers, landlords, and transport operators. I think we can reliably infer that a major shift in the law would cause significant disruption for the private sector. We can infer, further, that many who would bear the burden of this are small and medium-sized enterprises without ready access to specialist legal advice. And it is not to be ignored that we are talking of impacts on a private sector disrupted and weakened by the major impact of the Covid pandemic.[51]Thirdly, I believe that compelling considerations of legal certainty militate against a partial re-write of this aspect of the law. This approach would result in two different regimes: the statutory regime as enacted, which would remain in force so far as the public sector is concerned; and a regime for the private sector which did not conform with the law as it appears on the statute book. I am not entirely convinced by Mr Jaffey's submission that a clear and satisfactory boundary line can be drawn between the public and private sector for these purposes, by resorting to the Schedule to the Freedom of Information Act.[52]To my mind, these three considerations collectively carry a good deal of weight – the second and third especially so.[53]The fourth point is perhaps less weighty but still one of importance, in my opinion. The point is linked to each of the first three. Our decision is that(a) the intention of Parliament, as expressed in Article 23(2) of the UK GDPR, was not given effect when the Immigration Exemption was enacted;(b) for that reason the Immigration Exemption cannot stand and must be overridden; but(c) the demands of legal certainty make it necessary for the court to stay its hand and allow the Government and Parliament time to correct the errors in the DPA 2018 before we give formal effect to our conclusion, and declare the Immigration Exemption invalid. To hand back overall legislative responsibility to Parliament whilst making an immediate declaration in respect of the entire Exemption, but limited to its effect on one sector of society, would be a constitutional novelty in domestic terms. There appears to be no precedent for this in the jurisprudence of the CJEU. To adopt, in a slightly different context, what the Divisional Court said in Liberty at [76-77] , "these are deep constitutional waters in which the courts of this country have been and still are feeling their way … [and] should proceed with great caution."[54]The fifth and final consideration is that whilst the rights to data privacy and data protection with which we are concerned are important, indeed fundamental, we must consider the factual context. We are proposing to suspend our declaratory order for a period of a few months. The material before us does not suggest that this is an interference so important and significant as to make it necessary to go down this novel procedural avenue. The form of order[55]When we announced our decision we invited the parties to draw up a suitable order. For my part, I would make a declaration in the agreed wording which they have produced. This is that(1) The immigration exemption in Paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 is incompatible with retained EU law in that it does not satisfy the requirements of Article 23(2) of the UK GDPR.(2) The declaration in paragraph 1 shall be suspended until 31 January 2022 in order to provide a reasonable time for the Data Protection Act 2018 to be amended so as to remedy the incompatibility. I would, as already indicated, give the parties liberty to apply, on the basis that time would only be extended if some unexpected event was shown to require it.

Lord Justice Singh:

[56]I agree.

Lord Justice Underhill:

[57]I also agree. I wish to emphasise that, as Warby LJ says at para. 13 of his judgment, our power to suspend our declaration – in practice, to suspend the disapplication of the Immigration Exemption – derives entirely from retained EU law. It was not argued that the Court had any equivalent power at common law. Note 1 The provisions at issue were s 3 of the Representation of the People Act 1983 and s 8 of the European Parliamentary Elections Act 2002, and Article 20(2)(b) of the Treaty on the Functioning of the European Union (“TFEU”) and Article 40 of the Charter of Fundamental Rights (“the Charter”). [Back]

order

R v Secretary of State for Employment, ex p Equal Opportunities Commission [1995] 1 AC 1 . That is the remedy that is claimed in this case. But must the court, in such a case, inevitably make an immediately binding order? There is domestic authority to the contrary, starting before Brexit.

Cited in 4 later judgments