Campaigners have lost a High Court case challenging the “immigration exemption” to personal data rights. The judgment is R (Open Rights Group & the3million) v Secretary of State for the Home Department [2019] EWHC 2562 (Admin).

Paragraph 4, Schedule 2 of the Data Protection Act 2018 says that certain rights protected by the now famous GDPR do not apply when data is processed for the following purposes:

(a) the maintenance of effective immigration control, or

(b) the investigation or detection of activities that would undermine the maintenance of effective immigration control.

The rights that can be flouted under this immigration exemption include the right to a subject access request, where the Home Office can be compelled to hand over the file it holds on an immigrant. As Nick puts it, this is “often the only way to find out what the bloody hell is going on” with a client’s immigration history.

The judgment records that the Home Office invoked the immigration exemption in 59% of the 18,000 subject access requests it processed in the first year of the Data Protection Act’s operation. But it insisted that in the vast majority of cases, “the exemption has been used to prevent disclosure of only small elements of the overall case file, not the whole set of information”.

The campaign groups argued that the exemption should be struck down as contrary either to GDPR itself (which as an EU regulation takes priority over UK legislation) or to the EU Charter of Fundamental Rights. They suggested, among other things, that it was “open-ended and vague” and that there were “insufficient safeguards to constrain the exercise of a very broad discretion”.

But Mr Justice Supperstone found that it was all above board:

The Immigration Exemption may only be relied on if and to the extent that compliance with “the listed GDPR provisions” would be likely to prejudice the maintenance of effective immigration control or the investigation or detection of activities that would undermine the maintenance of effective immigration control

…

The “likely to prejudice” test and the requirements of necessity and proportionality provide, in my view, an adequate set of safeguards to protect individual data subject rights.

The court also rejected an interesting submission from Christopher Knight, representing the Information Commissioner, that the exemption would only be lawful if accompanied by statutory guidance on its use. Supperstone J held that “a legislative measure does not require to be accompanied by guidance as to proportionality in order to be lawful”. 

The unsuccessful claimants have already announced an appeal, saying that “Open Rights Group and the3million will continue the fight against the immigration exemption, seeking an immigration system and data protection framework that respects the rights of everyone”.

Reacting to the judgment, Rosa Curling of Leigh Day said that “millions of people are already feeling uncertain and anxious about their immigration status as we approach Brexit and our clients feel that the immigration exemption adds a further layer of uncertainty by removing transparency and the opportunity to correct mistakes in the immigration system”.