El Gizouli: Mutual Legal Assistance Meets Data Protection

On 25 March 2020, the UK Supreme Court issued R (El Gizouli) v Secretary of State for the Home Department [2020] UKSC 10.  Due to the COVID-19 global pandemic, this was the court’s first judgment to be handed down remotely.  It confirmed the importance of data protection laws to international transfers of personal information for law enforcement purposes and may have even broader ramifications as outlined below.

Background

El Gizouli was a judicial review brought by Maha El Gizouli, the mother of Shafee El Sheikh, a suspected member of the infamous UK terrorist group known as ‘The Beatles’.  Mr El Sheikh was captured in Syria in 2018 and is now in US custody.  The UK police previously investigated this group and collected certain information, including Mr El Sheikh’s personal information.  The success of any US prosecution of Mr El Sheikh now “depends critically” on that information (see [33]).

The US sought this information from the UK through mutual legal assistance (“MLA”).  MLA is an international legal regime allowing states to obtain overseas assistance with criminal investigations.  The UK typically only provides MLA where the requesting state gives certain assurances.  Where the death penalty is a possible punishment, UK guidance confirms that requesting states should provide an “assurance that such a sentence will not be carried out or will be commuted”.

Here, however, following US lobbying, the UK exceptionally provided this information without obtaining such a ‘death penalty assurance’.  Mrs El Gizouli argued that this breached obligations under the Data Protection Act 2018 (“DPA”) and common law.  She was initially unsuccessful before the Divisional Court but enjoyed more success in the Supreme Court.

DPA requirements must be expressly evaluated during MLA 

The Supreme Court unanimously held (see [6]) that the DPA must be specifically considered before the UK government provides personal information to foreign states through MLA.

The government accepted that the US had requested Mr El Sheikh’s ‘personal information’ and that its transfer amounted to ‘processing’ personal data for a ‘law enforcement purpose’ by a ‘controller’ under the DPA ([79]).  It also conceded that, when evaluating the US request, “the UK authorities gave no separate consideration to the requirements of the [DPA]” ([207]).  Nonetheless, the Divisional Court held that it was sufficient that there had been “substantial compliance” with the DPA (see [6]).

The Supreme Court disagreed.  It explained that, before providing personal information to a foreign state outside the European Union (“EU”) pursuant to MLA, the government should undertake “a conscious, contemporaneous consideration of whether the [DPA] criteria” have been met ([6]).  This requires “a direct, personal evaluation” ([158]) and “specific consideration” of the applicable statutory tests in advance ([219]); mere “ex post facto consideration of whether a transfer was justified” is insufficient ([218]).

Here, the decision to provide the information without a death penalty assurance “was based on political expediency” only ([227]).  As the DPA had not been expressly evaluated in advance, the decision was invalid.

Broader significance

This judgment may have broader significance.  First, in addition to finding that the DPA was a necessary gateway consideration, a majority expressed guarded support for Lady Hale’s further view that the DPA ordinarily prohibits “the transfer of personal data to facilitate a prosecution which could result in the death penalty” altogether ([15]; see also [153], [228], and [230]).  The court declined to formally endorse this without full argument, but their positive reaction indicates there is a significant possibility this principle would be adopted in an appropriate case.

Secondly, in dissenting comments ([102]-[147]), Lord Kerr would have gone even further by holding that that “it is unlawful at common law for the state to facilitate the execution of the death penalty against its citizens or others within its jurisdiction anywhere in the world” ([143]). Interestingly, he cited EU law in support, stating “[i]t cannot be irrelevant to the development of our common law that the UK was a member of the EU for more than 40 years” ([134]).  Lord Kerr further noted that the fact such a common law principle may go beyond European Convention on Human Rights (“ECHR”) jurisprudence did not undermine it, stating that, while the ECHR also informs the common law, it “should not be regarded as an inhibitor” ([147]).  Although Lord Kerr’s comments here were not supported by a majority (see [4]), his articulation of how the common law develops may inspire other areas.

Overall, the judgment indicates that MLA decisions by the UK government will be subject to potentially robust court review, notwithstanding that MLA is an exercise of a prerogative power.  This is a welcome development that will now hopefully guide the UK and others.