English court applies Article 49 GDPR derogation to allow a transfer of personal data to Ukraine

Background

This application concerned a request by JSC Commercial Bank Privatbank (the ‘bank’) for permission to disclose two schedules to its particulars of claim in English proceedings to the Ukrainian Bureau of Economic Security (the ‘BES’). The schedules contained personal data relating to a co-founder of bank who was a defendant in the English proceedings, accused by the bank of embezzlement.

A Ukrainian court had ordered disclosure of the schedules to BES in connection with its investigation into a potential fraud committed against the bank by another co-founder and defendant in the English proceedings.

The application

The bank applied for the English High Court’s approval to disclose the two schedules. Amongst other issues, the Court was required to decide if one of the derogations contained in Article 49 UK GDPR applied. In this regard, Article 44 prohibits the transfer of personal data outside the UK unless certain conditions as to adequacy (Article 45) or appropriate safeguards (Article 46) are met, or if a derogation (Article 49) applies.

In this case, the relevant derogations were Articles 49(1)(d) (“the transfer is necessary for important reasons of public interest”) and (e) (“the transfer is necessary for the establishment, exercise or defense of legal claims”). The defendants’ position was that neither derogation applied.

What happened

The Judge decided that the Article 49(1)(e) derogation was engaged because the Ukraine proceedings were a relevant “legal claim” and transferring the data was a necessary, targeted and proportionate means of establishing or exercising it.

In reaching his conclusion, the Judge relied on the ICO’s guidance that this derogation will apply (1) if “you or another person involved in the legal claim have received a request for information from an overseas regulator with a view to it potentially taking formal action” and (2) even if transfer is not “absolutely essential” but is a “targeted and proportionate way of achieving a specific purpose” which could not reasonably be achieved another way.

The Judge declined to reach a conclusion on whether the Article 49(1)(d) derogation applied, given his conclusion on Article 49(1)(e) and the speed with which the case has had to be argued and decided.

Conclusion

An individual’s right to protection of their personal data in the context of litigation has again come under the spotlight, this time in relation to Article 49. The effect of this decision is that the “legal claims” derogation is likely to apply, where a request for information (or order) is received from an overseas regulator (or court).

It should also be noted that this application was necessary because the defendants in the English proceedings opposed the disclosure. In the future, parties in the defendants’ position may conclude that the better option is to give their consent, avoiding the need to involve the Courts. Finally, it is notable that the judge gave significant weight to the ICO’s guidance on international transfers.