International cooperation in bringing terrorists and other serious criminals to justice is obviously desirable, but that does not mean that individual citizens’ personal data can be passed from state to state willy-nilly. The Supreme Court made that point in a guideline decision arising from the war in Syria.
The US government requested the UK authorities to provide mutual legal assistance (MLA) with a view to investigating the activities of a group of alleged terrorists who were said to have been involved in the murder of US and British citizens in Syria. The Home Secretary sought a full assurance that any information provided to the US would not be used directly or indirectly in support of a prosecution which might result in the imposition of the death penalty.
No such assurance was forthcoming, but the Home Secretary ultimately agreed to provide the information requested without requiring any assurance whatever. The mother of one member of the group subsequently failed in a judicial review challenge to that decision.
In ruling on her appeal against that outcome, a majority of the Court rejected arguments that domestic English law has evolved to the point where it recognises a free-standing principle prohibiting the provision of MLA that might facilitate the death penalty. Despite this country’s long-standing opposition to capital punishment, it was a matter for Parliament whether such a prohibition should be enacted.
In upholding the appeal, however, the Court found unanimously that the Home Secretary’s decision was contrary to the Data Protection Act 2018. Having been reached with no appropriate safeguards, it was based on political expediency rather than on considerations of strict necessity, as required by the Act.
The Court also noted that the Act requires data controllers to consider whether the fundamental rights and freedoms of data subjects override the public interest in disclosing personal data to foreign states. Those rights and freedoms include all those rights protected by the European Convention on Human Rights, particularly the right to life. Such considerations pointed towards an interpretation of the Act which would preclude the transfer of personal data to facilitate a prosecution which could result in the death penalty.
