Concern over United Kingdom’s proposed ‘immigration exemptions’ from Data Protection Bill
Dear Frans Timmermans, Věra Jourová, and Tiina Astola
We, the undersigned, write to express our concern regarding the UK Government’s incorporation of the General Data Protection Regulation into domestic law. Setting aside other areas of concern, the UK’s Data Protection Bill proposes an exemption that would remove individuals’ fundamental right to data protection if it is likely to prejudice “effective immigration control”.
This proposed exemption (‘the immigration exemptions’) will remove the right of individuals to receive information from a subject access request: a core mechanism in any immigration dispute. Further restrictions would remove the government’s responsibility to process an individual’s data in accordance with the principles of data protection including lawful, fair and transparent processing. The exemption would allow data to be shared across UK government institutions without accountability or opportunity for recourse.
The immigration exemptions would potentially leave EU citizens applying for residency post- Brexit without access to their personal data at the most crucial time. As a result, decisions taken about a person’s right to remain which may be based on incorrect information would not be rectified, because individuals would be unable to see that the personal data held is incorrect.
EU citizens could be mistakenly forced to leave the United Kingdom as a result of the immigration exemptions.
Further, the proposed immigration exemptions would appear to violate both the General Data Protection Regulation and the Charter of Fundamental Rights:
- The General Data Protection Regulation Article 23(1) stipulates that any restrictions underthe clause must “respect the essence of the fundamental rights and freedoms and [must be] a necessary and proportionate measure in a democratic society...”.
- Under Article 8 of the Charter of Fundamental Rights every individual in the European Union is entitled to the protection of personal data concerning him or her. This includes the right of access to data which has been collected concerning him or her, and the right to have it rectified.
The blanket immigration exemptions go beyond the necessity and proportionality of restrictions under Article 23 of the GDPR and directly interfere with an individual’s right of access to data, and for their data to be processed fairly under Article 8 of the Charter of Fundamental Rights.
We are concerned about the potential impact the immigration exemptions will have on the United Kingdom’s adequacy when it leaves the European Union. The judgment by the Court of Justice of the European Union in Maximillian Schrems v. Data Protection Commissioner C- 362/14, lays out at para 74 in no uncertain terms, that the practical requirement for adequacy requires:
“...protection essentially equivalent to that guaranteed within the European Union.”
And at para. 95:
“Legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter.”
Each of you represent an institution which holds a mandate to protect the interests of EU citizens and uphold the Charter of Fundamental Rights. That mandate includes the respect of these rights by member states.
We believe these proposed exemptions are particularly significant to all EU citizens currently resident in the United Kingdom in maintaining the protection of rights guaranteed to them in the Charter of Fundamental Rights.
We call on you:
- to communicate to the United Kingdom that the immigration exemptions must be removed to secure the compatibility with the essence of the fundamental right to data protection, and the Charter of Fundamental Rights; and
- to examine the exemptions impact on EU citizens’ ability to enforce their residency rights after Brexit under the agreements currently being brokered.
Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate, Oxford Martin School of the University of Oxford
Judith Rauhofer, Lecturer in IT Law, University of Edinburgh
Dr Andrew A. Adams, Deputy Director, Centre for Business Information Ethics, Meiji University, Tokyo, Japan
Anna Fielder, Trustee and Chair Emeritus, Privacy International
Mike O’Neill, Director, Baycloud Systems, The Oxford Centre for Innovation
Marie Georges, Independent expert and member of the FREE Group
Prof Andy Phippen, University of Plymouth
Dr Reuben Binns, Department of Computer Science, University of Oxford
Dr Robin Callender Smith, Professor of Media Law, QMUL Information Rights Judge and former Immigration Judge
Dr Paul Bernal, Senior Lecturer in IT, IP and Media Law, University of East Anglia Law School Milena Popova, Digital Cultures Research Centre, UWE Bristol
Dr. Maureen O. Mapp, Lecturer and Module leader for Cyberlaw, University of Birmingham Law School
Dr Duncan Campbell, Visiting Senior Fellow (Law and Sociology), University of Sussex
Dr. Nicholas J. Gervassis, Lecturer in Law, University of Plymouth
Damian Tambini, Associate Professor, London School of Economics
Dr Sally Broughton Micova, Lecturer in Communications Policy and Politics, University of East Anglia
Vian Bakir, Professor in Political Community and Journalism, Bangor University
Ray Corrigan, Senior Lecturer, Science Technology Engineering & Mathematics Faculty, The Open University
Lilian Edwards, Professor of E-Governance, Law School, Strathclyde University Marian Petre, Professor of Computing, The Open University
Blaine Price, Professor of Computing, The Open University
Andrew McStay, Professor of Digital Life, Bangor University
Marian Petre, Professor of Computing, The Open University
Milena Popova, Digital Cultures Research Centre, UWE Bristol
Note: This letter was sent in copy to Guy Verhofstadt, chief Brexit representative of the European Parliament, and the European Data Protection Supervisor.