The Retained EU Law Act and Regulations 2023/1417: Undercutting the UK's European Data Protection Rights Commitments?

Abstract

Both the Retained EU Law (Revocation and Reform) Act (REULA) and its Regulations 2023/1417 significantly reform UK data protection and raise tensions with the UK's Council of Europe commitments. Whilst including a non-binding incompatibility mechanism, REULA generally prohibits overriding other law for inconsistency with the UK General Data Protection Regulation (GDPR). Since key UK GDPR standards overlap with Convention 108+, Convention 108 and even the European Convention on Human Rights, there is an increased danger that contrary law will remain unremedied. Even if the Data (Use and Access) Bill partially reverses this, it would still immunise Data Protection Act 2018 exceptions such as those concerning immigration as successfully challenged twice in the Open Rights Group litigation. The Regulations 2023/1417 narrow the meaning of fundamental rights to European Convention rights alone, whereas both Convention 108 and 108+ adopt an open-textured and fully horizontal understanding which explicitly recognises a right to privacy (and, for Convention 108+, even data protection). There is a danger that these rights will be underweighted in domestic law. However, not only is the UK only a signatory of Convention 108+, but none of the discrete duties or specific rights included in or under any of these instruments, or required under the EU's data adequacy standard, are directly nullified.