I thank noble Lords who have spoken in this debate. As noble Lords will know, paragraph 4 of Schedule 2 to the Data Protection Act 2018 outlines specific rights under the UK GDPR that can be restricted if they would likely prejudice either
“the maintenance of effective immigration control, or … the investigation or detection of activities that would undermine the maintenance of effective immigration control”,
known as the immigration exemption. As noble Lords have pointed out, these regulations amend the immigration exemption, following the judgment in the case of Open Rights Group & another v the Secretary of State for the Home Department. This statutory instrument builds on existing safeguards of individual rights and should be welcomed.
8 pm
In its ruling, the court made it absolutely clear that it was up to the Government which limbs of Article 23(2) were relevant. At paragraph 54 of the judgment, Lord Justice Warby said:
“It may be open to the legislature to conclude that one or more of the matters listed in Article 23(2) is not relevant to this particular exemption. It may even be entitled to conclude that although a particular matter is relevant it is unnecessary to set limits any narrower than those contained in the GDPR itself.”
Recital 41 of the UK GDPR, to which the noble Lord, Lord Clement-Jones, refers, does not specify what is required by way of form or content of a “legislative measure”. Recital 41 states that:
“Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament”.
Recital 41 applies to legislative measures, and as such—