Alleged Data Breaches Do Not Automatically Invalidate Deportation-Revocation Decisions

1. Introduction

This judgment addresses the relationship between data-protection remedies, immigration judicial review and the constitutional protection of marriage. The applicants challenged the Minister for Justice’s refusal to revoke a deportation order affecting a Nigerian national married to an Irish citizen. They argued that the Minister had unlawfully processed the citizen spouse’s immigration history and had inadequately respected their marital and family rights.

The High Court rejected the challenge. Its central conclusion was that an alleged data-protection breach did not, in the circumstances, invalidate the immigration decision. The applicable data-protection legislation supplied separate remedies, and the applicants had not demonstrated that the disputed information produced an adverse finding or affected the outcome.

The court also distinguished between identifying insufficient evidence of a durable relationship and positively finding that a marriage was invalid, non-genuine or entered into for immigration purposes. That distinction defeated several grounds of challenge.

2. Background and Procedural History

The first applicant arrived in Ireland in 2015 and unsuccessfully sought international protection. His application for permission to remain, including a review concluded on 31 July 2019, was also refused. The review considered his relationship with the second applicant, an Irish citizen naturalised in 2013, but found insufficient substantive documentary evidence of a meaningful and durable relationship.

The judicial review sought an order of certiorari quashing the refusal of 15 May 2025 and declarations concerning the processing of the second applicant’s personal data. The pleaded sources of protection included Articles 7 and 8 of the EU Charter, Regulations 603/2013 and 2016/679, the Data Protection Act 2018, the Constitution and the European Convention on Human Rights.

The earlier permission-to-remain review was described as unlawful in the revocation application, but it had not itself been challenged. The proceedings therefore concerned the subsequent refusal to revoke the deportation order, not a direct review of the 2019 decision.

3. Summary of the Decision

The High Court refused the substantive relief sought. Its principal findings were:

• No automatic invalidity followed from an alleged data breach. Even assuming unlawful processing and the application of EU law, the applicants had not established a basis for quashing the section 3(11) decision.
• No adverse consequence from the disputed information was demonstrated. The Minister accepted the marriage and assessed the applicants’ family rights rather than treating the second applicant as lacking capacity to marry.
• The Minister had not found a sham or invalid marriage. Several pleaded grounds attacked conclusions that the decision did not actually contain.
• The proportionality assessment was legally open to the Minister. Marriage to an Irish citizen did not create an automatic entitlement to remain, particularly against the background of an existing deportation order.
• The declarations served no useful purpose in these proceedings. They had been advanced in support of the unsuccessful attempt to quash the immigration decision.

The court provisionally proposed awarding costs to the Minister, subject to the applicants’ opportunity to make written submissions.

4. Precedents Cited and Their Influence

A & B v The Minister for Justice, Ireland and the Attorney General & Ors. [2024] IEHC 183

This was the principal authority on the relationship between data-protection breaches and the validity of immigration decisions. Phelan J had considered challenges concerning a return order and the designation of the United Kingdom as a safe third country. The claimants sought to use alleged data-protection deficiencies to invalidate decisions under the immigration framework rather than simply obtain remedies for the alleged breaches themselves.

As described in the present judgment, Phelan J accepted that the relevant data exchanges and return decision fell within EU law because EU law controlled the conditions under which the return could occur. Nevertheless, alleged data-protection breaches did not invalidate the immigration decisions. Irish legislation supplied a complaints mechanism before the Data Protection Commissioner, enforcement measures and a civil action under section 117 of the Data Protection Act 2018.

The important distinction was between correcting or compensating for unlawful data processing and undoing a separate administrative transaction that had relied on the data. The statutory remedial scheme did not generally require such past transactions to be treated as void.

The applicants sought to distinguish that decision as involving a general designation challenge rather than their individual circumstances. O’Regan J rejected the distinction. The earlier litigation also concerned an individual return order, and the proposition advanced here—that allegedly unlawful processing invalidated a section 3(11) decision—would have wider application to other revocation decisions.

The court also noted that, although part of Phelan J’s decision was under appeal, its data-protection analysis was not.

AAA & Ors. v Secretary of State for the Homeland Department [2022] EWHC 3230

This English authority informed the reasoning in A & B, which the present court adopted. The judgment describes its central proposition as follows: not every breach of a legal rule occurring during the making or implementation of a public decision necessarily invalidates that decision.

The analysis turned on whether the alleged breach was integral to the legality of the immigration decision. The English court treated the relevant data-protection remedies as compliance orders or damages, rather than automatic invalidation of subsequent immigration decisions.

Its relevance was therefore remedial and structural: an unlawful act connected with a decision must be distinguished from an error that makes the decision itself unlawful. The present judgment also refers to two English Court of Appeal decisions considered by Phelan J, but does not identify them; their individual reasoning cannot be separately assessed from the supplied text.

Gorry v The Minister for Justice [2020] IESC 55

Both parties relied on this Supreme Court decision. O’Regan J drew on three aspects of O’Donnell J’s reasoning:

1. No automatic residence entitlement: citizenship of one spouse, marriage and prospective interference with cohabitation do not together create an automatic right for the non-national spouse to enter or remain in Ireland. However, a refusal of entry requires clear and persuasive justification.
2. Immigration history matters: an existing deportation order, particularly one made and evaded before marriage, materially changes the assessment. Refusing revocation will not ordinarily, for that reason alone, fail to respect marriage.
3. Durability is relevant: the length and durability of a relationship may reduce concerns that the marriage is directed towards obtaining an immigration benefit or circumventing immigration control.

The third proposition explained why the Minister could consider the limited evidence of cohabitation and relationship history without necessarily making a finding that the marriage was one of convenience. The first two supported the conclusion that the applicants’ marriage did not displace the Minister’s responsibility to assess immigration history and the public interest.

Smith and Dwyer

The applicants also relied on decisions identified in the judgment as Smith and Dwyer, concerning unlawfully obtained information used in criminal proceedings. O’Regan J distinguished them because they involved directives not raised in these proceedings and, importantly, the disputed information here had not been shown to underpin an adverse finding against the applicants.

The judgment does not supply their full titles or citations. Its treatment therefore supports a limited distinction, rather than a comprehensive account of their application outside criminal proceedings.

5. Analysis of the Court’s Legal Reasoning

5.1 Separating unlawful processing from an unlawful immigration decision

The disputed passage recorded that the second applicant had arrived in Ireland in 2003 with her then husband and that both had received permission to remain on the basis of an Irish citizen child. The decision also referred to the absence of evidence of divorce and information about the children’s father.

The court did not determine that this processing breached data-protection law. Instead, it tested the applicants’ claim on assumptions favourable to them: even if there had been unlawful processing, and even if EU law applied, would that justify quashing the refusal to revoke the deportation order?

Its answer was no. Section 3(11) did not make the validity of a revocation decision conditional on the absence of a data-protection breach. Meanwhile, the Data Protection Act 2018 provided procedures and remedies directed specifically at such breaches. The applicants had not challenged the adequacy of those remedies or shown that they had pursued them.

This reasoning should not be overstated. The judgment does not establish that data misuse can never be relevant to judicial review. It rejects the asserted route to invalidation in circumstances where the statutory scheme supplied separate remedies and no material connection to the challenged outcome had been demonstrated.

5.2 The missing connection between the information and the outcome

The applicants’ case also failed on the decision’s actual treatment of the information. Although the second applicant’s earlier marriage might theoretically have prompted a capacity objection, the Minister did not find that she lacked capacity to marry. The decision accepted the applicants’ marriage and expressly assessed their family life under Article 41.

The court therefore found no demonstrated adverse consequence flowing from the disputed information. The applicants had not identified how its inclusion affected the outcome. They had also not challenged the respondent’s affidavit asserting that no data-protection breach had occurred.

These points are distinct: the court neither established a breach nor found a material effect on the immigration decision. Consequently, the judgment is not authority that unlawful processing occurred but was judicially excused.

5.3 EU-law applicability: an alternative and qualified observation

The court referred to Article 2(2)(a) of Regulation 2016/679, which excludes processing in the course of an activity falling outside the scope of Union law. It expressed the view that a section 3(11) decision appeared to fall outside that scope because EU law did not control the making and enforcement of the deportation order.

This observation should be read alongside the earlier analysis, which assumed that EU law applied and still rejected certiorari. The result therefore did not depend exclusively on resolving the EU-law question. Nor should the observation be converted into a general proposition that all personal-data processing associated with national immigration decisions is exempt from the GDPR.

5.4 Evidential concerns were not findings of a marriage of convenience

The Minister considered the documentary evidence of cohabitation and durability inadequate. Apart from one joint gas bill, the applicants had not supplied the kinds of material the decision identified as potentially available: bank statements, housing records, revenue correspondence, references or photographs.

The decision stated that this evidential deficiency failed to remove the possibility that the marriage was directed, wholly or partly, towards achieving an immigration benefit. The court held that this was not equivalent to finding that the possibility had actually occurred.

That distinction was decisive. Several grounds alleged irrationality, inadequate reasons or procedural unfairness in reaching a conclusion that the marriage was non-genuine, invalid or one of convenience. Because the Minister had not reached those conclusions, the grounds did not establish the alleged errors.

The judgment thus demonstrates the importance of accurately identifying the administrative finding under challenge. It does not authorise an unsupported positive finding of a sham marriage.

5.5 Constitutional protection required balancing, not an automatic outcome

The Minister accepted the existence of family rights and weighed them against the State’s interests in border control, maintaining an effective immigration system and protecting economic well-being. The court considered this assessment consistent with Gorry.

The applicants relied on the first applicant’s favourable employment prospects and the second applicant’s permanent employment. They also invoked the financial thresholds in the Non-EEA National Family Reunification policy. The court noted, however, that evidence establishing the second applicant’s earnings had not been tendered; satisfaction of the threshold was assumed rather than proved.

Even on that assumption, financial eligibility did not resolve the wider proportionality assessment. The Minister relied on immigration control as well as economic considerations. The first applicant’s previous education and employment had not been documented, and the court considered that present household earnings did not guarantee that he would never require State support.

The conclusion was not that the family’s interests were legally irrelevant. Rather, the Minister had considered them and reached a balance that was open on the facts. Judicial review did not permit the court to replace that assessment merely because the applicants preferred a different outcome.

5.6 Pleadings and declaratory relief

The court confined its review to the relief and grounds authorised by the perfected leave order of 1 May 2026. Arguments advanced outside those grounds were not addressed.

It also declined the requested declarations because they had been raised to support the attempt to quash the immigration decision and served no useful purpose once that challenge failed. This was not a determination that a properly constituted data-protection claim could never succeed through the appropriate statutory procedures.

6. Complex Concepts Simplified

Section 3(11) application

A request that the Minister amend or revoke an existing deportation order. Here, the challenge concerned refusal of revocation, not a fresh appeal against the original order.

Certiorari

A court order quashing an unlawful administrative decision. It is not an automatic remedy for every wrong associated with the decision-making process.

Materiality

The connection between an alleged error and the decision challenged. The applicants did not show that the disputed personal information led to an adverse finding or affected the result.

Proportionality

An assessment of whether interference with protected rights is justified by the public objectives pursued. Recognising family rights does not predetermine which side of the balance must prevail.

Articles 7 and 8 of the EU Charter

Separate protections for private and family life and for personal data. Whether the Charter applies depends on the relevant connection with EU law.

Leave in judicial review

Permission to pursue specified grounds of challenge. Arguments outside the authorised grounds are not automatically before the court.

7. Significance and Likely Impact

First, the judgment extends an existing remedial distinction into section 3(11) litigation. Its principal contribution is applying the approach in A & B to an individual refusal to revoke a deportation order. Alleging unlawful processing is not, without more, a substitute for identifying an error that invalidates the immigration decision.

Second, it emphasises evidential precision. Future applicants relying on data misuse will need to identify both the alleged legal breach and its relevance to the decision, while explaining why the remedies provided by data-protection legislation do not adequately address their complaint.

Third, it reinforces the distinction between marriage and residence entitlement. A valid marriage attracts constitutional consideration, but does not erase immigration history or automatically require revocation. Evidence of the relationship’s duration and practical substance remains relevant.

Fourth, it warns against challenging findings that were never made. A decision expressing unresolved evidential concerns must be analysed as written, rather than recast as a categorical finding of deception or invalidity.

The decision’s limits are equally important. It did not conclusively determine whether a data breach occurred, did not comprehensively resolve the reach of EU data-protection law, and did not establish immunity from review where unlawfully processed information materially drives an adverse decision.

8. Conclusion

The High Court upheld the refusal to revoke the deportation order because the applicants had not established an error of fact or law. The alleged data breach neither automatically invalidated the decision nor was shown to have affected its outcome. The constitutional challenge likewise failed because the Minister accepted the marriage, considered family rights and reached a balance legally open on the evidence.

The central lesson is that judicial review requires a precise connection between the wrong alleged, the decision actually made and the remedy sought.