영국 데이터보호법상 출입국목적 면제조항과 개인정보보호

In 2021, the United Kingdom’s Court of Appeals ruled in favor of the plaintiff saying that there was an unlawful incompatibility between provisions in the U.K. Data Protection Act of 2018 (DPA) Schedule 2 Part 1, paragraph 4 and Article 23(2) and UK GEPR which is the implementatin of the European Unions’ General Data Protection Regulation of 2016 (GDPR) Article 23(2) due to lack of legislative measure required by UK GDPR 23(2). EU GDPR covers principles and exemptions of personal information protection and it was enforced since 2018 to EU member states. This case occurred in the middle of the Brexit process. After Brexit, the judgement came out and the UK paliament remanded the 1998 data protection law which went into effect on January 1, 2021. Among the changes that resulted were modifications to personal data protection. In the court case, the plaintiff claimed that the Schedule 2 part 1 paragraph 4 did not provide predictability with clear and precise phrases when it applies exemption to the protection given to the data subject. In addition, the plaintiff provided evidence that the degree of administrative error of the Immigration office operating the migrant service was as high as 10% even with the current easy excess of the documents. The Court of Appeals ordered the amendment of the article to comply with a legislative measure to accord to Article 23(2). After the court decision, Parliament revised the DPA immigration provision providing additional safeguards with clear authority in place. However, opinions are divided on whether a safeguard given by the amendment is sufficient. Some lawyers and legal activists are still not satisfied with the revision. They claim the revisions still lack appropriate safeguards which are considered to be the part and parcel of the court’s decision to fix since the Immigration Exemption Policy Document (IEPD) provides guideline and judgment source which is not legally enforceable. This precedent served as an opportunity to think about appropriate legislative measures to take with the immigration exemption clause in terms of subjective and procedural measures and great implications for other countries as well. Even with important stake such as public safety and maintaining effective immigration control, it is necessary to clearly and transparently establish and maintain the subjective and procedural standards of the protection net for personal information protection.