• Home
  • About us
  • People
  • Blog
  • News
  • Video
  • Webinars
  • Seminars
  • Podcasts
  • Publications
    • Journal Articles
    • Working Papers
    • OxHRH Annual Report
    • Books & Chapters
    • U of OxHRH Journal
  • Events
  • Journal
  • GDPR Compliance
  • Home
  • Home OHRH
  • Media
  • Search
  • Test page
  • Publications
  • About us
  • News
  • A big page
  • Contact
  • Disclaimer
  • Site Map
  • Legal
  • Event archive
  • Blog
    • Comments Policy
    • Contribute to the Blog
  • Events
  • Journal
  • People
  • publications test
  • Publications New
    • Inner Publications Landing
  • #16346 (no title)
Oxford Human Rights Hub logo
  • Home
  • About us
  • People
  • Blog
  • News
  • Media
  • Events
  • Publications
  • Journal

El Gizouli: Mutual Legal Assistance Meets Data Protection

Tim Cochrane - 13th April 2020
OxHRH
Right to Privacy
Data protection must be specifically considered before the government provides personal information to foreign states through mutual legal assistance, Tim Cochrane writes.

On 25 March 2020, the UK Supreme Court issued R (El Gizouli) v Secretary of State for the Home Department [2020] UKSC 10.  Due to the COVID-19 global pandemic, this was the court’s first judgment to be handed down remotely.  It confirmed the importance of data protection laws to international transfers of personal information for law enforcement purposes and may have even broader ramifications as outlined below.

Background

El Gizouli was a judicial review brought by Maha El Gizouli, the mother of Shafee El Sheikh, a suspected member of the infamous UK terrorist group known as ‘The Beatles’.  Mr El Sheikh was captured in Syria in 2018 and is now in US custody.  The UK police previously investigated this group and collected certain information, including Mr El Sheikh’s personal information.  The success of any US prosecution of Mr El Sheikh now “depends critically” on that information (see [33]).

The US sought this information from the UK through mutual legal assistance (“MLA”).  MLA is an international legal regime allowing states to obtain overseas assistance with criminal investigations.  The UK typically only provides MLA where the requesting state gives certain assurances.  Where the death penalty is a possible punishment, UK guidance confirms that requesting states should provide an “assurance that such a sentence will not be carried out or will be commuted”.

Here, however, following US lobbying, the UK exceptionally provided this information without obtaining such a ‘death penalty assurance’.  Mrs El Gizouli argued that this breached obligations under the Data Protection Act 2018 (“DPA”) and common law.  She was initially unsuccessful before the Divisional Court but enjoyed more success in the Supreme Court.

DPA requirements must be expressly evaluated during MLA 

The Supreme Court unanimously held (see [6]) that the DPA must be specifically considered before the UK government provides personal information to foreign states through MLA.

The government accepted that the US had requested Mr El Sheikh’s ‘personal information’ and that its transfer amounted to ‘processing’ personal data for a ‘law enforcement purpose’ by a ‘controller’ under the DPA ([79]).  It also conceded that, when evaluating the US request, “the UK authorities gave no separate consideration to the requirements of the [DPA]” ([207]).  Nonetheless, the Divisional Court held that it was sufficient that there had been “substantial compliance” with the DPA (see [6]).

The Supreme Court disagreed.  It explained that, before providing personal information to a foreign state outside the European Union (“EU”) pursuant to MLA, the government should undertake “a conscious, contemporaneous consideration of whether the [DPA] criteria” have been met ([6]).  This requires “a direct, personal evaluation” ([158]) and “specific consideration” of the applicable statutory tests in advance ([219]); mere “ex post facto consideration of whether a transfer was justified” is insufficient ([218]).

Here, the decision to provide the information without a death penalty assurance “was based on political expediency” only ([227]).  As the DPA had not been expressly evaluated in advance, the decision was invalid.

Broader significance

This judgment may have broader significance.  First, in addition to finding that the DPA was a necessary gateway consideration, a majority expressed guarded support for Lady Hale’s further view that the DPA ordinarily prohibits “the transfer of personal data to facilitate a prosecution which could result in the death penalty” altogether ([15]; see also [153], [228], and [230]).  The court declined to formally endorse this without full argument, but their positive reaction indicates there is a significant possibility this principle would be adopted in an appropriate case.

Secondly, in dissenting comments ([102]-[147]), Lord Kerr would have gone even further by holding that that “it is unlawful at common law for the state to facilitate the execution of the death penalty against its citizens or others within its jurisdiction anywhere in the world” ([143]). Interestingly, he cited EU law in support, stating “[i]t cannot be irrelevant to the development of our common law that the UK was a member of the EU for more than 40 years” ([134]).  Lord Kerr further noted that the fact such a common law principle may go beyond European Convention on Human Rights (“ECHR”) jurisprudence did not undermine it, stating that, while the ECHR also informs the common law, it “should not be regarded as an inhibitor” ([147]).  Although Lord Kerr’s comments here were not supported by a majority (see [4]), his articulation of how the common law develops may inspire other areas.

Overall, the judgment indicates that MLA decisions by the UK government will be subject to potentially robust court review, notwithstanding that MLA is an exercise of a prerogative power.  This is a welcome development that will now hopefully guide the UK and others.

Author profile

Tim Cochrane is an international disputes lawyer with experience in London, New York, and New Zealand. He is currently researching an MPhil in Law at Balliol College, University of Oxford focussing on privacy and white collar crime issues.

Citations

Tim Cochrane, “El Gizouli: Mutual Legal Assistance Meets Data Protection”, (OxHRH Blog, 14 April, 2020), <http://ohrh.law.ox.ac.uk/el-gizouli-mutual-legal-assistance-meets-data-protection/>, [Date of access].

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Related blog posts

Use of Facial Recognition Technology in India: A Function Creep Breaching Privacy
The Unconstitutionality of the “Publication of Notice of Intended Marriage” clause under the Indian Special Marriage Act
Ensuring the lawfulness of automated facial recognition surveillance in the UK

Contact Us

oxfordhumanrightshub@law.ox.ac.uk

Oxford Human Rights Hub
The Faculty of Law, University of Oxford,
St Cross Building,
St Cross Road,
Oxford OX1 3UL

© 2021 Oxford Human Rights Hub | Site by One


Sign up for the OHRH Newsletter

Your email address*:

New email sign up
reCAPTCHA
* Find out how we use your data