On the face of it the Irish Supreme Court’s decision in Minister for Justice v O’Conner [2018] IESC 3 has no place on a blog focused on information law matters as they apply in Scotland and the wider United Kingdom. The case involves a European Arrest Warrant (EAW) issued by the United Kingdom and the surrender of the individual to the United Kingdom under that EAW. The Irish Supreme Court has granted leave to Mr. O’Connor to appeal to it; this is so that a reference can to be made to the Court of Justice of the European Union. The context of that reference is the giving of notice by the United Kingdom under Article 50 of the Treaty on the European Union and that as a consequence the United Kingdom will leave the European Union.
It is not obvious what this has to do with information law at all; however, it might well have an impact upon the flow of personal data between the United Kingdom and the European Union.
The UK Government has identified a number of ‘red lines’ in its negotiations with the European Union; one of those red lines is that the Charter of Fundamental Rights of the European Union will cease to apply to the United Kingdom when it leaves the European Union. All of the public statements which have been made by Ministers is suggestive that the Charter will not be incorporated into UK domestic law and it will not agree to a treaty with the European Union which continues its application. Whether or not that is the case at the end of the day remains to be seen; however, it is creating uncertainty.
My initial thoughts on this case are that it could be significant beyond the question of extradition under the EAW scheme. From a reading of the judgment of the Irish Supreme Court, it is clear that there are fundamental issues of European Union Law to be addressed in this reference.
It is a consequence of the operation of Article 50 that at the end of the two year period provided for therein that the treaties cease to apply to the leaving State (subject to an agreement to extend the Article 50 period or any agreement between the EU and the leaving state which continues the application of EU law). At its most basic, it means that European Union Law ceases to apply to the leaving state. This is a very real problem and is the reason for the European Union (Withdrawal) Bill, which has its aim to ensure that the domestic statute book works and certainty is given as to what the law in the United Kingdom is.
So, what precisely does this have to do with information law? Articles 44-50 of the General Data Protection Regulation deal with transfers to third countries; a third country being a country which is outside of the Union. Upon Brexit the United Kingdom will be outside of the Union and the flow of personal data from controllers and processors inside of the Union to controllers and processors in the United Kingdom will need to be in compliance with Articles 44-50 of the GDPR.
What most people in the data protection world are hoping for is that the United Kingdom will get a favourable adequacy decision from the European Commission; which will enable the free flow of personal data between the Union and the United Kingdom on much the same basis as it is presently while the United Kingdom remains part of the European Union. However, many are sceptical as to whether the United Kingdom will be successful in gaining such a decision; it may not be enough simply to show that the GDPR still forms part of UK domestic law, but that is a topic for another blog post.
What appears to be the underlying issue in the reference being made by the Irish Supreme Court, is whether a person can be surrendered to the United Kingdom under a EAW while there is uncertainty about what the arrangements will be after Brexit in terms of that citizen’s rights under European Union Law. The Charter of Fundamental Rights of the European Union features a number of times in the judgment and seems to be one of the areas of EU law that is at issue (and Article 8 of the Charter guarantees rights to the protection of personal data).
It seems to me that if the opinion issued by the Court of Justice of the European Union in respect of the reference made is in any way supportive of Mr. O’Connor’s position, it could raise questions not only about personal data transferred between the Union and the UK post-Brexit; but also about personal data which is transferred pre-Brexit and which will continue to be processed in the United Kingdom post-Brexit.
This reference to the Court of Justice of the European Union is certainly one that data protection professionals ought to be keeping an eye on; it has the potential to cause severe headaches for controllers and processors who rely on personal data coming in from the other 27 members of the European Union.
If you would like advice or assistance with a privacy or data protection matter, or any other information law concern then contact Alistair Sloan on 0345 450 0123 or send him an E-mail.