Elgizouli, R. (On Application of) v The Secretary of State for the Home Department [2020] EWHC 2516 (Admin)

[2020] EWHC 2516 (Admin)

Case No CO/3082/2020

IN THE HIGH COURT OF JUSTICE

QUEEN'S BENCH DIVISION

DIVISIONAL COURT

Venue Royal Courts of Justice Strand, London, WC2A 2LL

Date 22/09/2020

Before

THE PRESIDENT OF THE QUEEN'S BENCH DIVISION

MR JUSTICE GARNHAM- - - - - - - - - - - - - - - - - - - - -

Between

THE QUEEN (ON APPLICATION OF MAHAClaimant

ELGIZOULI)Claimant

THE SECRETARY OF STATE FOR THE HOMEDefendant

DEPARTMENTDefendant

DIRECTOR OF PUBLIC PROSECUTIONSInterested Party

Richard Hermer QC and Julianne Kerr Morrison and Tim James-Matthews (instructed by Birnberg Peirce) for Claimant

Sir James Eadie QC and Hugo Keith QC and Victoria Wakefield QC and Christopher

Knight and Jason Pobjoy (instructed by Government Legal Department) for Defendant Tom Little QC (instructed by Crown Prosecution Service) for the Interested Party

Hearing Hearing dates: 11th September 2020

Approved Judgment

Dame Victoria Sharp:

Introduction

[1]This is the judgment of the Court to which we have both contributed.

[2]By this application, listed before us as a matter of urgency, Ms Maha Elgizouli (the claimant) seeks permission to challenge by way of judicial review a decision of the Secretary of State for the Home Department (the Secretary of State) to provide material to the Government of the United States pursuant to a request for Mutual Legal Assistance (MLA).

[3]The requested material relates to the alleged terrorist activities of Ms Elgizouli’s son, Shafee El Sheikh, formerly a British citizen, whose citizenship was revoked in 2014 pursuant to section 40(2) of the British Nationality Act 1981 on the basis that the national security threat he posed (including through activities in Syria) made it conducive to the public good to deprive him of it. The claimant’s son is currently under investigation for the most heinous offences in Syria arising out of his membership of a group of foreign terrorist fighters known as the 'Beatles’. This includes the suspected beheading of 27 individuals, including the murders of three US citizens, James Foley, Steven Sotloff and Peter Kassig and two British citizens, David Haines and Alan Henning.

[4]The decision under challenge was made on 24 August 2020 and these proceedings were commenced on 1 September 2020.

[5]Because of its urgency, we directed that this case be listed as a rolled-up hearing with the application for permission to be heard first, and the judicial review to follow if permission was granted. We heard full argument on 11 September 2020. Mr Tom Little QC, for the interested party, attended but took no part in the hearing.

[6]The principal issues for determination are: i. Whether the decision to provide MLA is compatible with the Data Protection Act 2018 (the DPA) and; ii. Whether the decision is irrational.

[7]Central to both issues is the question whether the provision of the material requested is strictly necessary or proportionate in circumstances where Mr El Sheikh may be prosecuted in this jurisdiction, and in particular, where the Crown Prosecution Service (the CPS) has recently sought the consent of the Attorney General to the commencement of criminal proceedings (for serious terrorist offences) against him.

[8]Notwithstanding the length of this judgment, we have reached the clear view that this claim for judicial review is not arguable.

The History

[9]On 25 March 2020, the Supreme Court handed down judgment in a previous case brought by Ms Elgizouli against the Secretary of State: see Elgizouli v SSHD

[2020] UKSC 10

allowing her appeal against a decision of this Court (the Lord Burnett of Malden CJ and Garnham J) reported at

[2019] EWHC 60 (Admin)

which had rejected her claim for judicial review. This earlier case had been heard by the Divisional Court on 8/9 October 2018 and judgment was handed down on 18 January 2019. The argument before the Supreme Court had taken place on 30/31 July 2019.

[10]The decision under challenge before the Divisional Court and the Supreme Court on that occasion was one made on 22 June 2018 by the then Secretary of State for the Home Department to accede to the request for MLA from the United States in respect of Mr El Sheikh and others, without seeking a full death penalty assurance. The relevant request for MLA had been made in June 2015 by the United States in connection with its ongoing criminal investigation into the commission by Mr El Sheikh and others of the offences of murder, conspiracy to murder and hostage-taking resulting in death. The request had been made under the Treaty between the Government of the United States of America and the Government of the United Kingdom of Great Britain and Northern Ireland on Mutual Legal Assistance in Criminal Matters The UK-US MLA Treaty was signed on 6 January 1994, entered into force on 2 December 1996 and was amended by an Exchange of Notes on 16 December 2004. On June 25, 2003, the United States and the European Union signed a Mutual Legal Assistance Agreement (the 2003 US-EU MLA Agreement). Article 3(2) of that agreement contemplated the signing of bilateral implementing instruments with all the then 25 EU member states. As so contemplated, in May 2009 the United Kingdom signed an implementing instrument with the United States, as to the application of the UK-US MLA Treaty. The Annex to that instrument reflects the integrated text of the operative provisions of the 2003 US-EU MLA Agreement and the UK-US MLA treaty signed on 6 January 1994. (the UK-US MLA Treaty).

[11]In agreement with the Divisional Court, the Supreme Court held by a majority (Lady Hale, Lord Reed, Lord Carnwath, Lord Hodge, Lady Black and Lord Lloyd-Jones; Lord Kerr dissenting) that it had not been unlawful in principle for the Secretary of State to authorise disclosure of material to the US Government to assist a United States criminal investigation and prosecution of Mr El Sheikh for terrorist offences committed in Syria which could carry the death penalty in the United States. However, in disagreement with the Divisional Court, the Supreme Court held unanimously that the Secretary of State’s decision did not meet the requirements for the transfer of personal data to a third country set out in section 73 of the DPA.

[12]The historical context to the present claim is provided in the judgments of the Supreme Court and it is not necessary to repeat that detail here. It is, however, necessary to set out some of what happened during the course of, and after, that earlier litigation.

[13]At the time the case was last before this Court, Mr El Sheikh was being held by Kurdish forces in Syria together with Alexanda Kotey, another member of the ‘Beatles’. It was the view of the CPS at that time that there was insufficient evidence to prosecute Mr El Sheikh in the United Kingdom and it would not be possible lawfully for the British authorities to secure Mr El Sheikh’s return to the United Kingdom to face prosecution. However, on 15 October 2019, the US authorities obtained custody of Mr El Sheikh. He remains in their custody to this day.

[14]On 3 June 2019, Ms Elgizouli commenced proceedings against the Director of Public Prosecutions (the DPP) by which she sought judicial review of his refusal to conduct what is called a “Full Code Test review” in respect of Mr El Sheikh. On 18 November 2019, those judicial review proceedings were compromised. The recitals to the order that followed recorded that it was made “upon the Defendant undertaking a Full Code Test review of whether there was sufficient evidence to prosecute Shafee El Sheikh in England”. It was agreed that in those circumstances, the proceedings against the DPP were academic.

[15]On 18 August 2020, the US Attorney General, Mr William Barr, wrote to the Secretary of State. That letter included the following:

“On behalf of the United States Department of Justice, I am writing to provide an assurance that, if the United Kingdom grants our mutual legal assistance request, the United States will not seek the death penalty in any prosecutions it might bring against Alexanda Kotey…or Shafee Elsheikh, and if imposed, the death penalty will not be carried out… If a new prosecution is to go forward in the United States, our prosecutors should have the important evidence we have requested from the United Kingdom available to them in their efforts to hold Kotey and Elsheikh responsible for their terrorist crimes. If we receive the requested evidence and attendant cooperation from the United Kingdom, we intend to proceed with the United States prosecution. Indeed, it is these unique circumstances that have led me to provide the assurance offered in this letter. We would hope and expect that, in light of this assurance, the evidence can and will now be provided promptly. However, time is of the essence. Further delay is no longer possible if Kotey and Elsheikh are to be tried in the United States, and further delay is an injustice to the families of the victims. Kotey and Elsheikh are currently held by United State military authorities in an overseas theater of military operations, and it is not tenable to continue holding them there for an extended period. Final decisions must be made about this matter. Accordingly, given these circumstances, it should be clearly understood that the United States will move forward with plans to transfer Kotey and Elsheikh to Iraq for prosecution in the Iraqi justice system unless, by October 15, 2020, all litigation in the United Kingdom seeking to prevent the use of United Kingdom evidence in a United States prosecution has been fully and finally resolved, and the United Kingdom has transferred the requested evidence to us, along with a commitment to provide ongoing cooperation with respect to such evidence for the duration of any legal proceedings. We also confirm that the material already provided by the United Kingdom in response to the mutual legal assistance request will not be used to seek the death penalty in any prosecutions the United States might bring against Kotey or Elsheikh, and if imposed, the death penalty will not be carried out. Moreover, we will not transfer any evidence already or subsequently provided to us by the United Kingdom to third countries that might impose the death penalty upon Kotey or Elsheik (and in any event will not transfer any such evidence to any third country without the express permission of the United Kingdom).”

[16]The US was aware of the nature of the material requested as in February 2018 FBI agents had inspected here the evidence gathered by UK Investigators: see Elgizouli (HC) para 12.

[17]On 24 August 2020, the United Kingdom Central Authority, International Directorate (the UKCA) presented a detailed ministerial submission to the Secretary of State and the Security Minister (the UKCA Submission) concerning the provision of MLA to the United States in respect of Mr El Sheikh. The UKCA Submission recommended that the Secretary of State should accede to the request for MLA subject to acknowledgement of the death penalty assurance and limitation on any further use of the material.

[18]The UKCA Submission was accompanied by an annex addressing “Data Protection Act considerations”. That annex included the following observations:

“4. The six data protection principles set out in Chapter 2 of Part 3 apply to the processing. 5. The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair. 6. Firstly, in order to be lawful, the processing must be based on law. In the present case, the processing is based on law in particular the UK/US MLA Treaty. 7. Secondly, the processing must be necessary for the performance of a task carred out for a law enforcement purpose by a competent authority. As to this: a. “Law enforcement purposes” is definined in the DPA as meaning “the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”. b. As set out in the main Submission, and as you know: i. The 2015 MLA request from the US relates to an investigation and potential prosecution of El Sheikh and Kotey. ii. The assurances letter of 18 August 2020 makes it clear that (i) there will be no prosecution of those individuals by the US without the material and (ii) if the material is provided, there will be such a prosecution. 8. Accordingly, and subject to paragraph 10 below, you may take the view that the transfer of material is necessary for the law enforcement purpose. 9. You should also consider whether the transfer would be proportionate. It is open to you to take the view that it is proportionate, bearing in mind all the considerations set out in the main Submission, in particular (i) the greatly reduced human rights concerns, now that a death penalty assurance has been provided, (ii) the severity of the crimes which the data subjects allegedly committed, and (iii) the available alternatives to US prosecution, particulary transfer to Iraq. 10. In the context of assessing necessity and proportionality, you should be aware that Lord Carnwath held that the ability to prosecute in the UK is relevant to the necessity of transfer when there are no death penalty assurances in place. We do not consider that the same applies where there are such assurances. However, even if it is relevant to consider the possiblity of domestic prosecution now that we have assurances, there is no general preference for a domestic prosecution inherent either generally or in our data protection obligations. So even if it were possible to say now that El Sheikh could be prosecuted in the UK, as Kotey himself could be, it would be still be possible, consistently with a necessity and proportionality test, to transfer the evidence. In this regard, you will want to take into account all the considerations set out in the main submission and in this Annex, including the UK’s obligations under the US/UK MLA Treaty. As already noted in the submission, there is particular urgency to transfer the evidence in this case given the 15 October deadline that the US have set. 11. Thirdly, on the basis that this might be “sensitive processing” (which applies if the data reveals certain information, such as political opinions or religious beliefs), you should also ask yourself: a. whether the transfer is “strictly necessary” for the law enforcement purpose. You may decide that the processing meets this test, for the reasons set out above (not least since the US cannot prosecute without it, and will prosecute with it). b. whether one of the “conditions for sensitive processing in Schedule 8” applies. Both Condition 2 (“the processing is necessary for the administration of justice”) and Condition 6(a) (“the processing is necessary for the purpose of, or in connection with, any legal proceedings (including propective legal proceedings)”) apply here.” a. “Law enforcement purposes” is definined in the DPA as meaning “the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security”. b. As set out in the main Submission, and as you know: i. The 2015 MLA request from the US relates to an investigation and potential prosecution of El Sheikh and Kotey. ii. The assurances letter of 18 August 2020 makes it clear that (i) there will be no prosecution of those individuals by the US without the material and (ii) if the material is provided, there will be such a prosecution. a. whether the transfer is “strictly necessary” for the law enforcement purpose. You may decide that the processing meets this test, for the reasons set out above (not least since the US cannot prosecute without it, and will prosecute with it). b. whether one of the “conditions for sensitive processing in Schedule 8” applies. Both Condition 2 (“the processing is necessary for the administration of justice”) and Condition 6(a) (“the processing is necessary for the purpose of, or in connection with, any legal proceedings (including propective legal proceedings)”) apply here.”

[19]On 24 August 2020, the Secretary of State decided to transfer the material requested to the United States. She also imposed under Article 7(3)(a) of the UK-US MLA Treaty a condition requiring that the material could only be used for the purposes of a federal prosecution of Mr Kotey and Mr El Sheikh and Attorney General Barr was informed accordingly. An email from her Private Secretary (National Security) of 24 August 2020 set out the Secretary of State’s conclusions. The reasons for that decision were set out in the UKCA Submission and in the ‘memo of decision’ which, in summary, adopted the reasoning of the UKCA Submission. The memo of decision included the following:

“The decision to transfer was strictly necessary, proportionate and fair, for the reasons set out in the Annex to the submission dealing with the Data Protection Act. In particular, the US cannot prosecute without the material and will prosecute with the material. She also took into account the greatly reduced human rights concerns now that a death penalty assurance has been provided, the severity of the crimes, and the alternatives to a US prosecution (in particular transfer to Iraq). Even if the CPS had concluded their review and a prosecution of El Sheikh was possible in the UK, it does not mean that a UK prosecution must be pursued over the US prosecution, even if feasible. The other requirements of the various data protection principles were made out, for the reasons set out in the Annex. As to the conditions which apply to an international transfer, and in particular condition 2, each of the gateways identified in the Annex were open to her. In particular, for the reasons set out in the Annex, there are “appropriate safeguards” in the meaning of s75(1)(a) or, in the alternative, s75(1)(b). In this regard, she took into account that she has agreed to move forward with making theDPPA 2 binding for MLA matters and 2 The EU-US Data Protection and Privacy Agreement (DPPA). The DPPA is dealt with in the annex, and paras 34 to 36 of the witness statement dated 8 September 2020 of Christine Hayes, the International Director in the 20. this may therefore be in place at the point of transfer. In any event, and alternatively, the “special circumstances” gateway would be available in this case. In particular, the transfer was strictly necessary for the law enforcement purpose of prosecuting the data subjects in the USA and/or for the same legal purpose. In all the circumstances set out in the Submission as a whole, including the Annex, the data subjects’ fundamental rights and freedoms (including the possible Article 3 argument) did not outweigh the very significant public interest in the transfer. Accordingly, Condition 2 was fulfilled.”

[20]On 26 August 2020, the Supreme Court formally issued a declaration that the then Secretary of State’s decision of 22 June 2018 to authorise the transmission to the United States of material had been unlawful under Part 3 of the DPA. The Supreme Court declined to make any order relating to the return of the material that had already been transmitted and it lifted the stay on the transmission of any further material.

[21]The Information Commissioner’s Office (ICO) had intervened before the Supreme Court in Ms Elgizouli’s first application for judicial review. Following the Secretary of State’s decision of 24 August 2020, the ICO indicated it wanted to assure itself the decision complied with the DPA. The GLD sent the decision and the UKCA Submission to the ICO on 27 August 2020. On the same date, the ICO’s Acting General Counsel sent an email in response indicating it had now had an opportunity to consider the detailed information provided and had no further questions in the light of its consideration of that information.

[22]Following an indication that the claimant intended to apply for urgent interim relief the Secretary of State undertook not to provide further material to the United States Government pursuant to any request for MLA in relation to Mr El Sheikh until 4 p.m. on 11 September 2020.

[23]On 27 August 2020, the CPS decided there was sufficient evidence to provide a realistic prospect of conviction and that it was in the public interest to prosecute Mr El Sheikh for several serious, terrorism-related offences reflecting his criminality in Syria from 2013 onwards. The CPS concluded that the relevant offences required either the consent of the Attorney General or the permission of the Attorney General for the DPP to consent to prosecution. On 1 September 2020, an application for consent, and permission to consent, was submitted to the Attorney General’s office. On 10 September 2020, the Attorney General indicated in answer to a request made by the claimant’s solicitors, that the case had recently been received by her office “and it is simply not possible to give an indication of time scale”.

[24]At the conclusion of the hearing in the present application, shortly before 4 p.m. on 11 September, we made an order prohibiting the Secretary of State from providing any further material to the United States Government until the handing down of this judgment or further order. the US and EU which the UK opted into. It provides extensive safeguards for data transferred to the US for law enforcement purposes. See further para 30 of the annex which states it is not legally binding as between the UK and US in relation to MLA matters, but both States have agreed to apply the safeguards in the MLA context as a matter of policy, and wish to make the DPPA’s provisions legally binding for MLA purposes as soon as possible. The legal framework

[25]We are principally concerned with the UK-US MLA Treaty as amended and the DPA.

[26]Article 1 of the UK-US MLA Treaty as amended, obliges the parties to provide mutual assistance for the purpose of proceedings, which by Article 19, means proceedings related to criminal matters and includes any measure or step taken in connection with the investigation or prosecution of criminal offences.

[27]On 23 May 2018 the DPA came into force. It is common ground between the parties that the transmission of material from the United Kingdom to the United States involves “processing” of “personal data” for a “law enforcement purpose” by a “controller” which is a “competent authority” for the purposes of Part 3 of the DPA. Any relevant processing must therefore be compatible with that part of the Act.

[28]Part 3 of the DPA implements the European Union’s Law Enforcement Directive (Directive EU 2016 /680) (the LED). The LED is directed to the “protection of natural persons with regard to the processing of personal data by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences…”.

[29]It is pertinent to set out two of the recitals to the LED. Recital 4 provides:

“The free flow of personal data between competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security within the Union and the transfer of such personal data to third countries and international organisations, should be facilitated while ensuring a high level of protection of personal data. Those developments require the building of a strong and more coherent framework for the protection of personal data in the Union, backed by strong enforcement.”

[30]Recital 7 provides:

“Ensuring a consistent and high level of protection of the personal data of natural persons and facilitating the exchange of personal data between competent authorities of Members States is crucial in order to ensure effective judicial cooperation in criminal matters and police cooperation...Effective protection of personal data throughout the Union requires the strengthening of the rights of data subjects and of the obligations of those who process personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data in the Member States.”

[31]Section 34 of the DPA establishes the general duty of the Data Controller. It describes six data protection principles with which the Data Controller must comply.

[32]Section 35 provides as follows: “(1) The first data protection principle is that the processing of personal data for any of the law enforcement purposes must be lawful and fair.” (2) The processing of personal data for any of the law enforcement purposes is lawful only if and to the extent that it is based on law and either—(a) the data subject has given consent to the processing for that purpose, or

(b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.…” 33.The second data protection principle is set out in section 36: “(1) The second data protection principle is that— (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected. (3) Paragraph (b) of the second data protection principle is subject to subsections (3) and (4). (4) Personal data collected for a law enforcement purpose may be processed for any other law enforcement purpose (whether by the controller that collected the data or by another controller) provided that— (a) the controller is authorised by law to process the data for the other purpose, and (b) the processing is necessary and proportionate to that other purpose. (5) Personal data collected for any of the law enforcement purposes may not be processed for a purpose that is not a law enforcement purpose unless the processing is authorised by law.” (a) the data subject has given consent to the processing for that purpose, or (b) the processing is necessary for the performance of a task carried out for that purpose by a competent authority.…” 33.The second data protection principle is set out in section 36: (a) the law enforcement purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and (b) personal data so collected must not be processed in a manner that is incompatible with the purpose for which it was collected. (a) the controller is authorised by law to process the data for the other purpose, and (b) the processing is necessary and proportionate to that other purpose.

[34]The third to sixth Data Protection Principles also fell for consideration by the Secretary of State but the claimant does not challenge the application of those principles in the case of this transfer.

[35]Section 73 sets out principles governing international transfer of personal data:

“(1) A controller may not transfer personal data to a third country or to an international organisation unless— (a) the three conditions set out in subsections (2) to (4) are met, and (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State other than the United Kingdom, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State. (2) Condition 1 is that the transfer is necessary for any of the law enforcement purposes. (3) Condition 2 is that the transfer— (a) is based on an adequacy decision (see section 74), (b) if not based on an adequacy decision, is based on there being appropriate safeguards (see section 75), or (c) if not based on an adequacy decision or on there being appropriate safeguards, is based on special circumstances (see section 76). (4) Condition 3 is that— (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or (b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21,24 to 28,34 to 51, 54and 56 of Schedule 7— (i) the intended recipient is a person in a third country other than a relevant authority, and (ii) the additional conditions in section 77are met.” (a) the three conditions set out in subsections (2) to (4) are met, and (b) in a case where the personal data was originally transmitted or otherwise made available to the controller or another competent authority by a member State other than the United Kingdom, that member State, or any person based in that member State which is a competent authority for the purposes of the Law Enforcement Directive, has authorised the transfer in accordance with the law of the member State. (a) is based on an adequacy decision (see section 74), (b) if not based on an adequacy decision, is based on there being appropriate safeguards (see section 75), or (c) if not based on an adequacy decision or on there being appropriate safeguards, is based on special circumstances (see section 76). (a) the intended recipient is a relevant authority in a third country or an international organisation that is a relevant international organisation, or (b) in a case where the controller is a competent authority specified in any of paragraphs 5 to 17, 21,24 to 28,34 to 51, 54and 56 of Schedule 7— (i) the intended recipient is a person in a third country other than a relevant authority, and (ii) the additional conditions in section 77are met.”

The Competing Arguments

[36]The written arguments for this hearing are to be found in the claimant’s Statement of Facts and Grounds and the defendant’s skeleton argument. It appears that the CPS decision of 27 August 2020 was not available to the claimant at the time of the drafting of the Statement of Facts and Grounds. The oral arguments advanced on her behalf reflected this development, albeit Mr Richard Hermer QC for the claimant said it made no material difference to the arguments advanced.

[37]There were however two matters dealt with in the written arguments which it is not necessary for us to address. At the hearing before us Mr Hermer no longer advanced the proposition set out in the Statement of Facts and Grounds that disclosure would put the United Kingdom in breach of

Article 3 of the European Convention on Human Rights

. It follows that no complaint is made by the claimant about the likely conduct of the proceedings in the US federal courts if a United States prosecution were to follow transfer of the data, or likely conditions in detention if Mr El Sheikh was convicted. Further, the claimant now accepts that the disclosure of material to the United States raises no additional question under section 73 of the DPA beyond the need to establish that disclosure was strictly necessary.

[38]The defendant’s skeleton argument addressed the question whether the proper test might be one of necessity rather than strict necessity. Sir James Eadie QC, who appeared for the defendant, submitted however that the Secretary of State had applied both tests, that is, necessity and strict necessity and that this particular issue was therefore academic. Both counsel were content to proceed on the footing that strict necessity was the appropriate test for the Court to consider and we have approached the case on that basis.

[39]Mr Hermer said that the DPA was the lex specialis for transfer of data generally and for international transfers of data for law enforcement purposes in particular. Both the LED and the DPA reflected a “deliberate calibration” of the importance of data protection in law enforcement. The test of necessity, he said, applies to the objective facts, without precondition or assumption. Consistent with this submission, Mr Hermer argued that there was no justification for interpreting the DPA so as to give greater emphasis to the duties established by the treaties for mutual legal assistance. Section 35 and section 73 of the DPA, Mr Hermer said, made it clear that transfer of data was only permissible if strictly necessary and proportionate. The DPA and the LED post-date the UK-US MLA Treaty and the plain purpose of the DPA was to provide greater protection for data subjects than had previously been the case.

[40]He referred in particular to para 8 of the judgment of Lady Hale in Elgizouli in the Supreme Court where she said:

“Part 3 of the 2018 Act makes provision about the processing of personal data by competent authorities for “the law enforcement purposes” and implements the European Union’s Law Enforcement Directive (Directive (EU) 2016/680) (“the LED”) (section 1(4)). That Directive is therefore a legitimate aid to the interpretation of the 2018 Act. The law enforcement purposes listed in section 31 include the investigation, detection and prosecution of criminal offences. Chapter 5 of Part 3 deals with the transfer of personal data to third countries or international organisations. Sections 73 to 76 set out the general conditions which apply to such transfers (section 72(1)(a)). The datacontroller cannot transfer personal data unless three conditionsare met (section 73(1)(a)).”

(emphasis added)

[41]Against that background, his core case on the DPA can be briefly stated. As he put it, the claimant’s case stands or falls on the contention that following the recent decision of the CPS, disclosure was neither strictly necessary nor proportionate given the real possibility of a domestic prosecution. In the light of previous statements made by both the US and UK Governments he said there was a real possibility that US authorities would no longer seek to prosecute Mr El Sheikh and would withdraw their request for MLA with the result that the law enforcement purpose relied on by the Secretary of State would “become redundant in the very near future.” In those circumstances, he submitted, on the objective and particular facts of the present case, the Secretary of State could not demonstrate that it was strictly necessary and proportionate to transfer data to the United States, whether in respect of Mr El Sheikh or other data subjects (who would have given witness statements for example) who were entitled to the same protection as Mr El Sheikh.

[42]His case on necessity was, he submitted, supported by Lord Carnwath’s concluding observations in Elgizouli at para 229 where he said:

“It seems that circumstances may have changed since the hearing of the appeal, in that the Crown Prosecution Service is understood to be reconsidering the possibility of a prosecution in this country. That would clearly be relevant to any reconsideration of the issues by the Secretary of State, in particular the “necessity” of the transfer. I would seek further submissions on the appropriate form of order.”

[43]Mr Hermer took his case on rationality shortly. He submitted by reference to para 16 of the UKCA Submission, that the Secretary of State had erred in applying a test that “refusal to accede to an MLA request must be rare or expectational” to her decision on necessity and proportionality under the DPA. He said that given the clear statutory wording in the DPA, it is irrelevant whether requests for mutual legal assistance were only rarely refused. He further submitted that it was irrational to seek to secure justice for the families of the victims of what Mr El Sheikh was alleged to have done, without considering the benefits of a UK prosecution, having regard in particular, to the factors that pointed in that direction, including that Mr El Sheikh was a former United Kingdom citizen, some of his victims were United Kingdom citizens and where much of the investigation had been conducted in the United Kingdom. It was also irrational to make the decision to accede to the MLA request before a decision had been made by the CPS as to whether or not Mr El Sheikh would be prosecuted, as this effectively prevented the CPS from exercising its function in determining the appropriate forum for his prosecution.

[44]Sir James argued that international co-operation in law enforcement is a positive and recognised virtue in the international legal order. That he said was clear from the recitals to the LED. There was nothing in the equivalent EU instruments to suggest that the possibility of a prosecution in an EU country was a bar to the provision of mutual legal assistance to the United States. He said that there was a powerful case for providing assistance to the United States Government. First, he said, the request was made pursuant to the UK-US MLA Treaty. Secondly, the United States authorities sought the material for the purpose of prosecuting Mr El Sheikh. The letter from Attorney General Barr made clear that the provision of the material was essential. Without it they would not prosecute; with it they would prosecute. The transfer of material was intended to support that prosecution. Thirdly, he said the United States was a friendly and trusted ally, “an MLA partner”. The MLA process was designed to ensure that material that one state needed for the purpose of investigation and prosecution is provided swiftly and efficiently. The purpose was to ensure that each state can reach an informed decision as to the charges they conclude ought to be laid. Given that Attorney General Barr had responded to the decision of the Supreme Court by providing a (full) death penalty assurance, a refusal now to honour the obligations under the MLA risked causing serious damage to the relationship with the US. Fourthly, he said that given that the death penalty assurance had now been provided, this was a very different case from that considered by the Supreme Court; in fact, it was now a “run of the mill case”. Fifthly, Sir James said that the available “alternatives have now shrunk”. As was clear from Attorney General Barr’s letter, the alternative to the provision of the material sought is the transfer of Mr El Sheikh to Iraq for prosecution there. He is now in US custody and it was for the US authorities to make their own decision about his future detention. The Secretary of State took the United States at its word on this subject.

[45]Sir James submitted there was no proper basis for an argument that the Secretary of State could not lawfully accede to an MLA request because there was a possibility of prosecuting the person concerned in England. He said that were there such a principle it would logically apply to requests for MLA at the stage of investigation, the stage when charges were being considered and at the stage when charges were brought. He said there was nothing in the UK-US MLA Treaty to create such an obstacle to compliance with an MLA request, nor, it was to be noted, in the equivalent treaty on MLA between the United States and the European Union. There was nothing either in the domestic guidelines on mutual legal assistance to support such a suggestion or in the caselaw to suggest that as a matter of common law, there was such a restriction. The basis for the invention of such a restriction as a matter of common law was unclear and it was impossible to delineate the relevant principles.

[46]Further, the foundation he said, of the claimant’s case, was illegitimate speculation about what might occur in the future. The claimant’s assertions about how those involved might act and react amounted to an invitation to the Court to infer that the United States would not do what it said, in a letter from its Attorney General, it intends to do.

Discussion: The DPA 2018

[47]We start with some general observations about mutual legal assistance. Mutual legal assistance is a method of co-operation between states for obtaining assistance in the investigation or prosecution of criminal offences, and in most cases, is requested and provided pursuant to international legal (treaty based) obligations. The decision to provide MLA is an exercise of prerogative power. The Secretary of State has broad discretionary powers to co-operate, even in the absence of an underlying treaty. Assistance is provided in the interests of reciprocity and the general public interest in combating crime. The provision of effective MLA to foreign authorities is considered a key part of Her Majesty’s Government’s work in tackling crime and furthering cooperation in this area, and it is said on behalf of the Secretary of State that refusals of MLA are rare and exceptional.

[48]The UK-US MLA Treaty imposes an obligation on the US and the UK to accede to requests for MLA from the other state (subject to certain limited discretionary limitations on assistance in Article 3 of that treaty) in connection with proceedings relating to crime. There is no entitlement in that treaty - or it is to be noted in equivalent international MLA treaties, including between the European Union and the United States - to refuse or delay a request on the basis that the requested State wishes to consider a domestic prosecution or has decided to prosecute (save in the limited circumstances where Article 5(4) of the UK-US MLA Treaty applies, and it is not suggested it does here).

[49]That said, there can no doubt that, in the event of conflicting provisions, the DPA, as primary legislation which post-dates the MLA Treaty, would be the governing provision. In our judgment however there is no conflict between the DPA (and the LED which it reflects) and the UK-US MLA Treaty. The two regimes, properly understood, respect and support each other. Neither qualifies the essential structure of the other. In simple terms, where a decision to accede to an MLA request may engage privacy rights and data protection issues, this consideration is addressed, as the defendant submits, by way of application of the requirements of the DPA, and it is clear from reading the decision and the UKCA Submission, this is precisely what occurred in this case.

[50]The UKCA Submission addressed the relevant DPA considerations in detail; it invited the Secretary of State in reaching her decision to confirm that she had given explicit consideration to those considerations and that she was content that the relevant criteria were fulfilled, which is what she then did.

[51]The LED recognises the dual objectives of facilitating the free flow of personal data for law enforcement purposes whilst ensuring the appropriate level of protection of personal data: see Recitals 4 and 7 set out at para 29 and 30 above. Part3of the DPA makes provision for the processing of personal data by competent authorities for law enforcement purposes and implements the LED. Chapter 5 of Part 3 of the DPA, which includes sections 72 to 78, applies to transfers to third countries such as the USA. Neither the LED nor the DPA seeks to reduce the ambit of MLA agreements. Instead they require that when those agreements are in play, the State to whom the request for MLA is addressed must apply the data protection principles in formulating its response.

[52]Disclosure is only possible if it is necessary, to the appropriate degree, for the law enforcement purpose in question. But once that necessity is established, the process of mutual legal assistance operates to ensure that co-operation between States can take place as agreed in the relevant treaty. This applies to all data which is requested, which in the present case, includes the sensitive data of Mr El Sheikh and others whose data is included in the material to be disclosed.

[53]The essence of the case for the claimant as we have said, is that the ultimate objective of both the United Kingdom and United States Governments, was the prosecution of Mr El Sheikh; that when determining whether the proposed disclosure was strictly necessary or proportionate, the data controller was required to consider the alternative means of securing that ultimate objective and that because a prosecution of Mr El Sheikh was likely to be possible in England, disclosure of material to the United States was not necessary or proportionate.

[54]In our judgment, this fundamentally misstates the question the data controller is required to consider.

[55]The correct approach is to be found in the wording of the LED and the DPA. It is convenient to set out parts of the wording of both. Article 8 of the LED provides that “member states shall provide for processing to be lawful only if and to the extent that the purpose is necessary for the performance of a task carried out by a competent authority for the purpose set out in art 1(1), namely the prevention, investigation, detection or prosecution of criminal offences”. Article 1(1) is brought into domestic law by section 31 of the DPA, which defines law enforcement purposes as including “the purposes of the prevention, investigation, detection or prosecution of criminal offences …”. Article 8 is brought into domestic law by section 35(1) of the DPA which sets out the first data protection principle, pursuant to which processing must be necessary or, if sensitive processing, strictly necessary for the performance of a task carried out for a law enforcement purpose. It follows from the wording of the Directive and the DPA that the necessity requirement attaches to the task in question.

[56]The second data protection principle set out in section 36 requires that the law enforcement purpose for which personal data is collected must be specific, explicit and legitimate and processed in a manner which is compatible with the purpose for which it was collected. Personal data collected for one law enforcement purpose may be processed for another law enforcement purpose provided the processing is necessary and proportionate to that other purpose. Again, the test is directed to the particular law enforcement purpose in question.

[57]The same principle applies when data is transferred to a third country. Section 73(2) requires that the transfer must be necessary for any of the law enforcement purposes. Accordingly, when a controller contemplates a transfer of data to a third country, she must be sure that it is necessary for a law enforcement purpose such as the investigation or prosecution of a criminal offence.

[58]In the present case the proposed transfer of data to the United States authorities pursuant to its request, is for the purpose of investigation and prosecution of Mr El Sheikh in the United States. This is a valid law enforcement purpose. On a proper reading of the LED and the DPA, whether processing (for the specified law enforcement purpose) is strictly necessary or proportionate is a question to be answered by reference to that particular task and not (as Mr Hermer submits) by reference to an inchoate or generalised objective. There is no scope therefore for arguing that the processing is not necessary (or is disproportionate for that matter) because the relevant objective is “prosecution” and Mr El Sheikh might be prosecuted here.

[59]In short, the structure and the wording of the DPA and the LED requires focus on specified and identified functions by those with responsibility for data processing. Both the DPA and the LED test the validity of any processing by reference to the precise task for which the processing will be carried out. Here the task is prosecution by the US authorities; and for that task, disclosure of the requested material is strictly necessary and proportionate. With regard to necessity, the evidence is that with the data the United States authorities will prosecute; without it, the United States authorities cannot prosecute. Since the objective of facilitating a prosecution in the requesting state can only be achieved by disclosure of the material, disclosure is also proportionate.

[60]We consider the reliance placed on Lord Carnwath’s observations set out at para 42 above, to be misplaced (whether for the purposes of the argument under the DPA or on rationality, and there was some suggestion it was material to both).

[61]It is to be noted that the UKCA Submission referred expressly to this part of Lord Carnwath’s judgment (thus, on the issue of rationality, even if the ability to prosecute in the UK was a relevant factor, it was expressly considered). The annex dealing with the DPA said:

“In the context of assessing necessity and proportionality, you should be aware that Lord Carnwath held that the ability to prosecute in the UK is relevant to the necessity of transfer when there are no death penalty assurances in place. We do not consider that the same applies where there are such assurances. However, even if it is relevant to consider the possibility of domestic prosecution now that we have assurances, there is no general preference for a domestic prosecution inherent either generally or in our data protection obligations. So even if it were possible to say now that El Sheikh could be prosecuted in the UK, as Kotey himself could be, it would be still be possible, consistently with a necessity and proportionality test, to transfer the evidence. In this regard, you will want to take into account all the considerations set out in the main submission and in this Annex, including the UK’s obligations under the US/UK MLA Treaty. As already noted in the submission, there is particular urgency to transfer the evidence in this case given the 15 October deadline that the US have set.”

[62]The possibility of the US providing a death penalty assurance was not canvassed in the previous proceedings for judicial review either before this court or the Supreme Court; that possibility appeared to have been entirely ruled out by the US authorities. As Sir James observed, Lord Carnwath made his observations in the context of a case where the death penalty was a real risk if the UK data made possible a US trial. No argument was addressed to the Supreme Court on the position if a death penalty assurance was provided, and the Supreme Court’s judgment does not determine that issue.The conclusion that, even if Mr El Sheikh could be prosecuted in England, it would still be necessary and proportionate to transfer the data to the US authorities remained a conclusion properly open to the Secretary of State.

Discussion: Rationality

[63]So far as rationality is concerned, as we have said, this ground was shortly taken by Mr Hermer – in our view, rightly so. On the face of the decision, as the defendant submits, all the relevant issues, including the obligations under the DPA, were carefully and conscientiously considered; there were good reasons to accede to the request for MLA, which arose out of an ongoing US investigation into the most shocking of criminal offences, including the murder by beheading of US citizens, and the nature of the material sought and the purpose to which it would be put by the US fell plainly within the scope of the UK-US MLA Treaty.

[64]The requirements of the DPA and the MLA were addressed separately in the UKCA Submission, and the Secretary of State was invited to consider and apply the correct discrete legal considerations to each. In particular, the submission on the DPA was contained in a separate annex which addressed the requirements of (strict) necessity and proportionality; whereas the reference to MLA refusals being rare and exceptional related to the application of the MLA Treaty when looked on its own. Mr Hermer is right to say that rarity and exceptionality is not the right test under the DPA. However, in considering what was required by the DPA, this was plainly not the test that the Secretary of State applied.

[65]In our view there is no principled basis and no authority for the submission that it is irrational for the Secretary of State to provide mutual legal assistance to US authorities because Mr El Sheikh may be prosecuted here. As the defendant puts it, the particular proposition that the Secretary of State was under an obligation not to accede to the MLA request unless and until a decision on prosecution was made here, or because a prosecution might take place here, is simply wrong. It equates to an argument that no MLA request should be acceded to where the person that is the subject of the criminal investigation may be liable to prosecution in the requested state, unless and until that prosecution is first dealt with. There is no warrant under the UK-US MLA Treaty for such an approach, and the basis of mutual legal assistance would be fundamentally undermined were such an approach to be adopted.

[66]Nor is there any foundation for the suggestion that the prospect of prosecution here was a matter which the Secretary of State failed properly to consider. The UKCA Submission fairly and properly addressed both the possibility and potential relevance of a prosecution in England.

[67]In particular, it said:

“12…The Crown Prosecution Service are reviewing whether there is now sufficient evidence to charge El Sheikh (and whether any additional charges arise for Kotey). If a charging decision is reached by the CPS, some (or all) of the charges under consideration will need the consent of the Attorney General. The process is expected to take several weeks… 13. The absence of a CPS charging decision does not preclude the sharing of evidence with the US for the use in their investigation and/or prosecution. It is perfectly legitimate for two countries to be investigating individuals at the same time and parallel investigations are not uncommon. Execution of the MLA request does not interfere with our own domestic investigation. Providing the remaining evidence to the US could lead to the transfer of Kotey and El Sheikh for a US federal prosecution before a decision is made whether to charge El Sheikh in the UK. However, we do not see that as a good reason to delay execution of the MLA request. There is no obligation to that effect in the US/UK MLA treaty. A US prosecution with death penalty assurances would support our longstanding objective to secure justice for the victims and their families whilst maintaining national security and supporting our opposition to the death penalty…”

[68]The question as to which was the better forum for a prosecution of Mr El Sheikh was not the question before the Secretary of State. She was being asked to provide material that would assist in a contemplated US prosecution, pursuant to a treaty that provided for material to be shared between prosecuting authorities in such circumstances.

[69]Moreover, a positive response to the request for MLA did not mean there could be no prosecution of Mr El Sheikh in England. It is not uncommon for the prosecution of individuals to be contemplated in more than one jurisdiction; and this is not a bar to a state party acceding to an MLA request whether under the MLA treaty or the DPA. The decision to accede to an MLA request did not prevent the CPS formulating charges against Mr El Sheikh, and it will not preclude bilateral discussion by the independent prosecuting authorities about the appropriate forum for any subsequent trial. See, for example, the Guidance for handling criminal cases with concurrent jurisdiction between the UK and US; and the CPS Guidance on the handling of cases where the jurisdiction to prosecute is shared with prosecuting authorities overseas. Mr El Sheikh is of course accused of the murder of both US and UK citizens; and it is not known whether the proposed US prosecution will relate to all of those murders or only those of US citizens.

[70]Whilst the UK Government was proposing to provide MLA without a death penalty assurance, this was an unusual case. Notwithstanding the barbaric nature of the offences alleged, now that the death penalty assurance has been given it has become, as Sir James put it, “run of the mill”. Provided the conditions of necessity and proportionality under the DPA were satisfied, in our view the Secretary of State was entitled to accede to the MLA request.

[71]We remind ourselves that this is an application for permission to apply for judicial review. We are not the primary decision-makers exercising our own judgment as to the appropriate forum for a prosecution. We are concerned only with the lawfulness and rationality of the Secretary of State’s decision. Previous expressions of preference as to where the prosecution should take place are of no relevance to the challenge mounted before us.

[72]Finally, it is to be observed that intrinsic to the claimant’s case under the DPA and with regard to rationality are speculative assertions, rather than “objective facts” viz. that if the CPS decide to prosecute Mr El Sheikh, it is possible that the US authorities will decide not prosecute, the request for MLA will be withdrawn and the law enforcement purpose will become redundant in the near future. Furthermore, when asked in the course of argument about what might be regarded as a curious feature of this litigation, namely that it could bring about the very result the claimant is concerned to avoid (the transfer of Mr El Sheikh to the Government of Iraq) Mr Hermer said that if there was a real possibility of a United Kingdom prosecution it was likely that the 15 October deadline set out in Attorney General Barr’s letter would be extended.

[73]None of the pronouncements made by the US Governmentafter the judgment of the Supreme Court to which Mr Hermer drew our attention in this context (to the effect that they would prefer foreign terrorists to be prosecuted in their country of origin) related specifically to Mr El Sheikh.He is, after all, alleged to be concerned in the murder of US citizens. But in any event, the evidence before the Secretary of State is contained in the letter from Attorney General Barr which is unequivocal as to the US authorities’ intentions. The August letter says nothing to support the inference that the US would abandon its prosecution of Mr El Sheikh if the UK is prepared to prosecute, let alone extend the 15 October 2020 deadline. It is to be noted, as Sir James pointed out, that the US authorities have made and maintained their request for MLA when they were aware of the judgment of the Supreme Court which made reference to the prospect of prosecution in the United Kingdom.

[74]The Secretary of State was plainly entitled, if not positively obliged, to have regard to the views of the US authorities as expressed, and to take Attorney General Barr at his word in formulating her response. We see no possible basis on which it could properly be argued that the Secretary of State fell into error by so doing. She was not obliged to go behind his letter which was entirely unambiguous: the US authorities wanted the data from the UK for the purpose of a prosecution of Mr Kotey and Mr El Sheikh in the United States. If the material sought was received the US intended to proceed with a prosecution. That was the reason why the death penalty assurance was given. If the data were not provided by 15 October 2020 there would be no US prosecution and the US would transfer the two men to the Iraqi justice system.

Conclusions

[75]For the reasons given, we have concluded that this application is not properly arguable, and we refuse permission to apply for judicial review. On the handing down of this judgment, the Order referred to at para 24 above, prohibiting the Secretary of State from providing any further material to the United States Government, has now ceased to have effect.