UK immigration data exemption faces further legal challenge

The UK government’s controversial ‘immigration exemption’ from the Data Protection Act 2018 faces a further legal challenge from human rights groups. The case is set to be heard in the Court of Appeal on 23 February 2021. An initial legal challenge was launched in the summer of 2019.

According to a report published in Computer Weekly, a lawsuit has been filed on the grounds that ‘everyone, regardless of their nationality or residence, should have their fundamental rights and freedoms protected as stated under GDPR.’

General Data Protection Regulations (GDPR) were introduced across the EU on 25 May 2018, but UK visa and immigration enforcement agencies were given exemption from having to adhere to the legislation.

Access to personal data

The exemption, specified in schedule 2 of the Data Protection Act 2018, allows the Home Office to refuse access to personal data held about individuals if doing so could ‘prejudice the maintenance of effective UK immigration control.’

In July 2019, digital campaigning organisation Open Rights Group (ORG) and the3million, which represents EU citizens living in Britain, argued in the High Court that the exemption was too extensive and undermined GDPR and the EU’s Charter of Fundamental Rights.

The exemption for UK visa and immigration authorities not only affects EU citizens, but any person who has dealings with any state body or company involved in UK immigration control. This includes refugee applicants and people affected by the Windrush scandal.

Although the Court refuted the arguments presented by the campaign groups and ruled that the exemption was lawful – having deemed that the purposes for which, and the categories of data to which it may be applied, were appropriately defined – the challenge in 2019 highlighted that the government had used the exemption to refuse access to data in 60% of UK immigration-related cases.

Accountable UK immigration system  

A founding member of the3million, Nicolas Hatton, wrote in a post on fundraising site Crowd Justice: “The3million and Open Rights Group are looking forward to once again standing up for an accountable immigration system and a fair data protection framework that respects everyone’s right to access their personal data, regardless of nationality or country of origin.”

In an interview with Computer Weekly, Matthew Rice the Scotland director of ORG, said that the exemption, the first suppression of law of its kind in 20 years of UK data protection legislation, has been justified by the UK government on the basis that it needs to ‘prevent people from getting advanced warning that they are to be removed from the UK and consequently disappearing’.

Mr Rice said: “There was no evidence to suggest that under previous data protection law…people were making subject access requests [SARs], getting back that they were due to get a visit from the immigration services, and then running away.”

“The other thing to bear in mind is that the exemption is blunt because immigration control isn’t defined in the act or in any part of UK law, and it’s not just about the Home Office or borders. Any data controller can apply this exemption – it’s available to your doctor, your landlord, your school, your local authority, any number of persons that might hold personal data about you,” Mr Rice added.

NHS and Home Office data sharing

Referring to a specific example, Mr Rice pointed out that a person’s healthcare records are often included in data sharing agreements between the NHS and the Home Office. This has been proven to prevent people seeking medical assistance when they need it for fear of their information being passed to UK immigration authorities.

According to Mr Rice, there is no concrete way to tell how and when the exemption has been applied as the Home Office does not notify people when responding to SARs.

Rice told Computer Weekly: “We found in pre-litigation…that the Home Office were not informing people of when the exemption was being engaged, so people were just receiving their response from the SARs and having data removed from it, but it wouldn’t say this data has been removed because of this exemption”

The ORG director did acknowledge that there is a system in place giving people the opportunity to challenge a data controller’s decision to withhold personal information, but said it was pointless if a person has no idea that their data is being withheld in the first place.

Rights violated

Rice argued that failure to disclose personal data under the UK immigration exemption ‘not only interferes with an individual’s access rights, but a range of other digital rights afforded under GDPR, such as the right to rectification, erasure and restriction of processing.’

ORG, working alongside lawyers with experience in making SARs, reportedly found numerous errors occurring in records that without access could have led to those individuals effected being deported from the UK.

Meanwhile, responses to a number of Freedom of Information (FoI) requests made by ORG show that use of the clause has increased since the 2019 High Court challenge, rising from 60% to 70%.

Rice said: “While ORG and the3million better understand the amount that the exemption is being used, there’s still no way to determine the criteria and categories of personal data that it’s being applied to, or whether it’s being applied disproportionately against certain nationalities.”

“If we’re seeing the use of it increase, that suggests that it’s becoming easier to apply…so we’re continuing to hope the court sees the errors in the government’s way of constructing this law and begin to change it,” Mr Rice added.

Political repercussions

Mr Rice hinted that the exemption has political repercussions for the UK, but said that it was unlikely this would be mentioned in the courtroom.

With the UK and EU still disagreeing over several issues, including a much publicised dispute over visa-free travel for musicians, there are fears over the exchange of data between Britain and the EU, which hinges on the Tory government securing a data adequacy agreement from the EU.

Without this decision, British businesses potentially face issues with exchanging data with EU subsidiaries, customers and suppliers.

It’s understood that the immigration exemption represents a contentious issue for securing a data adequacy agreement with the EU because the clause directly affects citizens of the EU.

MEPs specifically stated in a mandate given to the European Commission by the European Parliament for Brexit negotiations that the exemption is an area of ‘major concern.’

Following the hearing on 23 February, Mr Rice said that he expects a decision from the Court of Appeal within ‘four to six months of the case being heard.’

Workpermit.com can help with Sponsor Licences

If you need help with employing Skilled Workers and help to apply for a Sponsor Licence, including complying with your Sponsor Licence obligations, workpermit.com can help.

For more information and advice on Sponsor licences, please contact us on 0344 991 9222 or at london@workpermit.com