The High Court has ruled that the government’s second attempt to produce an immigration exemption to the Data Protection Act 2018 is still incompatible with the UK General Data Protection Regulation (GDPR). Only a week after the hearing, the judgment in R (on the application of the3million & Anor) v Secretary of State for the Home Department & Anor [2023] EWHC 713 (Admin) has been published.  

The immigration exemption

Data protection laws give people various rights over their personal information, including the ability to request a copy of what an organisation has on file about them. This right is crucial for people trying to get information about their immigration case or history from the Home Office. Many migrants who are initially refused status in the UK are subsequently granted it on appeal. Decisions cannot be properly challenged if legislation prevents the availability of evidence through Subject Access Requests and therefore the ability to challenge mistakes in the data.

The immigration exemption appears in Schedule 2 of the Data Protection Act 2018. It allows the Home Office and privately contracted companies to refuse someone’s requests for access to personal data held about them on the grounds that it might “prejudice the maintenance of effective immigration control”. The exemption can also prevent migrants from being able to object to their data being used for automated decision-making, or being deleted.

The case

Yesterday, the High Court decided that this exemption is incompatible with Article 23 GDPR. But the exemption has been challenged before, in 2018. Following this initial challenge, in May 2021 the Court of Appeal ruled that the immigration exemption was unlawful because it did not meet the safeguarding requirements for exemptions listed in the GDPR, including in relation to the purpose of processing the data, the scope of the restrictions, or protections to prevent abusive use of the data.

After the first judgment, the government were given until the end of January 2022 to introduce legislative amendments that made the exemption compatible with these requirements. Before introducing their amendments, the government consulted the Open Rights Group and the3million, who brought the judicial review claims. They said that the changes were inadequate because the draft still did not achieve compliance with the mandatory requirements of Article 23(2). The Secretary of State went ahead and made the changes as drafted anyway, and the Open Rights Group and the3million subsequently issued their second judicial review claim.

The importance of data protection in immigration

Mr Justice Saini set out a number of reasons why data to which the immigration exemption is applied is inherently “special” in nature compared with other citizens’ data rights. It falls within the meaning of Article 9(1) GDPR, meaning it is data “revealing racial or ethnic origin”. It requires a higher level of protection because the processing of it is more intrusive and the data is more likely to be private.

The individual in question is very obviously likely to be in a vulnerable position, “with a significant imbalance of power as against the immigration authorities”. For many, processing their data will not necessarily be done with genuine and free consent, as in other circumstances.

Anyone is entitled to make a complaint to the Information Commissioner or bring a case to court. But individuals subject to immigration control are likely to be seeking to exercise their rights in a particularly time-sensitive context. They will therefore be more reliant on the Home Office to apply the immigration exemption with care, and only so far as necessary. Where an individual suspects this has not been done, a Subject Access Request should provide access to data for analysis, appeals and where necessary amendments to decisions.

In around 66% of these requests made in the first five months of the existence of the new immigration exemption the Home Office failed to provide a full response, siting “immigration control” as the reason. Such extensive use of the immigration exemption shows that clear and precise safeguards are necessary.

A second attempt at a compliant immigration exemption

Instead of introducing legislative safeguards in compliance with Article 23, the government outsourced safeguards to a policy document which stated that the Home Office and its contractors were “to have regard for” such safeguards. In response, a second judicial review was lodged, which took place in the High Court last week.

Opting for a policy document does not meet the requirements of being a legally enforceable legislative matter:

“The cure is straightforward: the measures to satisfy the relevant provisions of Article 23(2) need to be set out in either legislation, or a code endorsed by Parliament, with binding legal effect in domestic law. An obligation to merely “have regard to: a code or policy will not do.”

Legislative amendments, rather than vague policy changes, are important because they would help to reintroduce much-needed scrutiny so that errors and data misuse cannot go undetected.

Saini J concludes his judgment by making declaratory orders that the immigration exemption is unlawful. The orders are suspended for a short period of time, to allow the government to implement compliant legislation.

The government’s refusal to adequately address the amendments to the exemption the first time suggests that their priority is maintaining a digital hostile environment above compliance with data protection and a transparent immigration system. As the increasingly hostile environment in the UK often sees migrants being treated as second-class citizens, this ruling is an important step forward in safeguarding, but it also shows another way in which the government is trying to erode the human rights framework post-Brexit. The fact that a second judicial review had to be brought on this point worryingly emphasises the weakness of parliamentary scrutiny today.