The Supreme Court puts the DPA in MLA – but will Brexit mean the victory is short-lived?

Earlier this year, in Elgizouli v Secretary of State for the Home Department [1], a seven Justice Supreme Court ruled unanimously that the Secretary of State had acted unlawfully in providing to the US authorities mutual legal assistance (‘MLA’) – in the form of the product of UK police enquiries – which would be used to facilitate the prosecution of offences carrying the death penalty. The court declined to establish a common law principle that facilitation of the death penalty through the provision of MLA is unlawful. Rather, the unlawfulness arose from the Secretary of State’s failure to take into account the provisions of the Data Protection Act 2018 (‘DPA’) concerning the transfer of personal data to third countries.

This article explores the consequences of this judgment, not just for death penalty cases, but for all cases in which the provision of MLA to an overseas prosecutor engages the DPA. Because the DPA implements EU law, the judgment also illuminates the post-Brexit future of MLA once the transition period ends on 31 December 2020. On this date, the DPA will be amended, leading to a divergence between the UK and the EU’s data protection regimes. This will create problems for prosecutors in multi-jurisdictional investigations, as well as opportunities for defence lawyers to disrupt those investigations.

The judgment

The appellant’s son (E) was alleged to have travelled from the UK to Syria to support a terrorist group. The group was suspected of involvement in numerous murders, including of US and UK citizens. In June 2015, the US sought MLA in respect of a criminal investigation, requesting materials gathered by the UK police. The UK requested an assurance that the death penalty would not be sought against anyone found guilty. The US declined to give this assurance. In January 2018, E was detained by the Syrian Democratic Forces. In June 2018, the Home Secretary acceded to the MLA request without obtaining a death penalty assurance. The Divisional Court upheld the decision to provide MLA but certified the following issues of public importance: (a) whether it was unlawful for the Secretary of State to provide MLA to a foreign state that would facilitate the imposition of the death penalty on the individual in respect of whom the evidence was sought; and (b) whether (and if so in what circumstances) it was lawful under the DPA, as interpreted in light of EU data protection law, for law enforcement authorities in the UK to transfer personal data to law enforcement authorities abroad for use in capital criminal proceedings.

On the first issue, the court observed that the UK had a clear policy of opposing the death penalty in all circumstances. In countries subject to the European Convention on Human Rights (‘ECHR’), the right under Article 2 and Protocol 13 not to be subjected to the death penalty was recognised as a fundamental right. However, there was no settled rule of customary international law to this effect. The law of the ECHR prohibited extradition or deportation of an individual to another state where there were substantial grounds for believing that they would face a real risk of being subjected to the death penalty. However, there was no equivalent established principle that prohibited the sharing of information relevant to a criminal prosecution in a non-abolitionist country. In order to preserve legal certainty, the common law had to be developed incrementally and on established principles, rather than the more dramatic change envisaged here, which was the prerogative of the legislature. For these reasons, the Justices (with the exception of Lord Kerr) declined to recognise a common law principle that the provision of MLA is unlawful where it will be used to facilitate the imposition of the death penalty in a foreign state.

On the second issue, the court observed that the transfer of personal data to a third country was prohibited unless the three conditions in section 73 DPA were met. It was the second condition (Section 73(3)) that was at issue, namely whether the transfer was: (a) based on an adequacy decision of the European Commission; (b) if not based on an adequacy decision, was based on there being appropriate safeguards; or (c) if not based on an adequacy decision or appropriate safeguards, was based on special circumstances. In this case, it was common ground that the transfer had not been based on an adequacy decision of the European Commission. The tests of “appropriate safeguards” and “special circumstances” had required specific and structured consideration by the Secretary of State. The DPA implemented Directive 2016/680 (‘the Directive’), which was therefore a legitimate aid to interpretation of the DPA. Recital 71 of the Directive was relevant to “appropriate safeguards” and left little room for discretion when it stated that “personal data will not be used to request, hand down or execute a death penalty or any other form of cruel and inhuman treatment”. Nor did the transfer meet the “special circumstances” condition. The Secretary of State’s decision had been based on political expediency rather than these statutory criteria. For these reasons, the Justices unanimously held that the Secretary of State had acted unlawfully in failing to take account of the requirements imposed by the DPA on transferring personal data to third countries, and thus upheld the appeal.

Consequences for death penalty cases

Will the judgment change the approach of the UK authorities when they receive future MLA requests concerning an overseas prosecution for capital crimes without obtaining a death penalty assurance?

The judgment does not mean that the Secretary of State can never provide MLA lawfully in these circumstances. If, for example, the MLA request is not for personal data, the DPA has no application and, there being no common law prohibition, the UK could lawfully accede to it. If, however, the MLA request is for personal data, the court suggested, albeit in obiter remarks, that there may be extreme circumstances in which the Secretary of State could lawfully provide the MLA, but only if the transfer was “urgently necessary to save life or prevent an imminent crime”. In upholding the UK’s international obligation to protect the right to life in Article 2 of the ECHR, the Secretary of State might lawfully reach the view that the need to provide information which could save lives (in, say, a devastating terrorist attack) outweighs the countervailing argument against facilitating the imposition of the death penalty.

However, in the majority of MLA requests in relation to which the imposition of the death penalty is a possibility, there will be no such urgency or threat to life, and accordingly no such Article 2 balancing exercise. In relation to these requests, assuming they are for personal data, it is difficult to see how the Secretary of State could satisfy the requirement of “appropriate safeguards” in Section 73(3) DPA (interpreted in light of Article 71 of the Directive) without both seeking and obtaining a death penalty assurance.

Whilst this is a principled approach, there are good reasons for thinking that the Secretary of State may not always adhere to it in future. Elgizouli turned on an analysis of Section 73(3) DPA, which, as noted above, requires that the data transfer is (a) based on an adequacy decision of the European Commission; (b) if not based on an adequacy decision, is based on there being appropriate safeguards; or (c) if not based on an adequacy decision or appropriate safeguards, is based on special circumstances. When the transition period ends on 31 December 2020, Section 73(3) will be amended so that, instead of an adequacy decision of the European Commission, the transfer must be based on domestic adequacy regulations instead. A new Section 74A will be brought into force on the same date, which will empower the Secretary of State to make adequacy regulations to designate third countries (and/or entities in those countries) as affording an adequate level of data protection. In Elgizouli it was common ground that the European Commission had not delivered an adequacy decision concerning the US law enforcement authorities, which fell outside the list of designated entities in the European Commission’s EU-US Privacy Shield. In a post-Brexit world, however, the Secretary of State will not be bound by the European Commission’s adequacy decisions and will be free to make its own determinations. The Secretary of State could therefore choose to designate the US – or certain US prosecuting authorities – under the new adequacy regulations, avoiding a repeat of the debate in Elgizouli, and permitting future transfers of data to the US in compliance with the amended DPA, even in prosecutions for capital crimes.

If this proposition seems far-fetched, it is worth recalling the last occasion on which Parliament legislated for the death penalty in the field of MLA – the Crime (Overseas Production Orders) Act 2019 (COPO). COPO only requires the UK to seek a death penalty assurance, not to obtain one, before an overseas country is designated as a bilateral partner. ^[2] The Government might well amend the DPA along similar lines, determining that the US affords appropriate levels of data protection in adequacy regulations issued under Section 74A DPA, subject only to a COPO-style requirement that the UK seeks (but need not obtain) a death penalty assurance.

Consequences unrelated to the death penalty

The Supreme Court’s judgment has consequences which extend beyond death penalty cases. It places the DPA front and centre of the analysis the Secretary of State must perform before acceding to any transfer of personal data in response to an MLA request, regardless of the seriousness of the crime or the nature of the punishment. The process of structured decision-making regarded as mandatory by the Supreme Court – which the Secretary of State abjectly failed to perform in Elgizouli – can no longer be glossed over or ignored. A documentary record will need to be maintained justifying why the three conditions in Section 73 DPA are satisfied, in order to defend any future claim that the data transfer was unlawful. The same applies to requests under COPO, in which the overseas request for electronic data is not processed by the Secretary of State but is sent directly to the UK-based private entity holding the data. Data controllers in these private entities will need to perform the same documented analysis under Section 73 DPA in order to resolve whether they are acting lawfully in transferring the data overseas.

The judgment also helps to illuminate the post-Brexit future of MLA, in that it highlights how the UK’s political desire to assist the criminal justice process in countries outside the EU (including but not limited to the US) will create a divergence between the UK and the EU’s data protection regimes. This divergence will have damaging consequences for the UK’s ability to cooperate with EU member states on cross-border criminal matters. The UK’s ability to continue to share data with EU member states, and vice versa, is contingent on the UK’s future willingness to conform to EU data protection requirements and its recognition of the jurisdiction of the European Court of Justice (‘CJEU’), which frequently issues judgments interpreting EU data protection law. However, the UK’s Brexit negotiators have consistently said that the UK has no intention of doing either of these things. If that remains the UK’s position by 31 December 2020, the UK would be unlikely to retain direct access to important databases of EU criminal intelligence, such as the Schengen Information System, and will exercise reduced influence through Europol and Eurojust on EU criminal justice policies.

The flipside of this divergence is that defence lawyers will have opportunities to disrupt joint investigations brought in the UK and an EU member state, whether formalised under a Joint Investigation Team (‘JIT’) or conducted on an informal basis. If the UK ultimately affords data protection to suspects in criminal investigations which is diluted from its EU equivalent, and if the UK rejects the jurisprudence of the CJEU, these suspects may be well-advised to challenge whether the transfer of data from the EU to the UK is lawful under, for example, the EU Charter of Fundamental Rights. How would an EU member state satisfy itself that the UK – which is now empowered to make its own determinations of adequacy diverging from those of the European Commission – is able to retain data lawfully and safeguard against its onward transfer to jurisdictions outside the EU? Where data was transferred to the UK under a JIT or another pre-Brexit EU criminal justice measure, what will replace these measures to afford the suspect equivalent guarantees of data protection? These arguments may seem technical, but they will provide a fertile new ground for defence lawyers to disrupt cross-border criminal investigations between the UK and EU member states.

Conclusion

Elgizouli is a fascinating insight into how modern statutes such as the DPA can be interpreted to uphold time-honoured fundamental rights, in the face of what the Supreme Court witheringly described as the Secretary of State’s political expediency. But the victory may be short-lived. As the UK hunts for trading opportunities outside the EU, it will likely become ever more willing to assist the criminal justice process in countries with poor human rights records and/or a willingness to use the death penalty. Brexit creates not only the commercial imperative but the legal freedom to provide this assistance, in that it removes the straightjacket of the European Commission’s adequacy decisions and the data protection jurisdiction of the CJEU. This will open up a new battleground for defence lawyers representing clients embroiled in multi-jurisdictional investigations. And in the hands of an unprincipled Secretary of State, this new-found freedom from the EU could become a recipe for yet more criminal justice decisions motivated by political expediency.

[1] [2020] UKSC 10

[2] Indeed, the drafting of COPO partly explains why the Supreme Court was unwilling to accept a common law principle that facilitation of the death penalty through the provision of MLA was unlawful.