Briefing by ORG and the3million raises concerns about the Immigration Exemption in the Data Protection Bill before its Second Reading in the House of Commons on 5 March 2018.
The briefing is also available in pdf format.
The Government has introduced the Data Protection Bill with a new exemption to protection of personal data (Schedule 2 Clause 4). The ‘immigration exemptions’ would remove the fundamental right for individuals to access their personal data when it would prejudice “effective immigration controls” or “the investigation or detention of activities that would undermine the maintenance of effective immigration control.”
The Government claims to have limited the scope of this exemption while the Bill was in the House of Lords. New clauses mean the immigration exemption does not apply to the right to portability and the right to rectification, while the earlier version of the Bill removed all the rights given to data subjects in the EU’s General Data Protection Regulation (GDPR). However, these changes are cosmetic and will not reduce the negative impact of the measures, as rectification requires having access to the data and portability generally does not apply to public authorities.
The Open Rights Group and the3million still have serious concerns about the current version of the immigration exemption (Schedule 2 Clause 4) and the consequences of passing the Bill with this exemption for millions of EU citizens in the UK. We therefore urge you to amend the Data Protection Bill to delete the immigration exemption in Schedule 2 Clause 4.
The immigration exemption is a blanket exemption, potentially affecting all foreigners involved in immigration cases and their families. The Bill is being introduced as EU citizens face a new process proposed by the UK government, requiring them to apply for “settled status” after Brexit. We are concerned that this creates a two-tier data protection system, where EU citizens and other migrants effectively have fewer rights to access their personal data than British citizens.
Individuals involved in migration disputes would not have the right to obtain their personal information from the Home Office. This is the most basic requirement to be able to handle an administrative dispute. Immigration lawyers routinely use Subject Access Requests to obtain information about clients from the Home Office, and the immigration exemption will make it harder for them to represent their clients effectively – for example, where applications are refused due to an error, or if a client is making an appeal against a Home Office decision. This is a serious concern given the 10% error rate2 in immigration status checks, and particular errors including deportation letters sent to lawful European residents.
The proposed restrictions of subject rights would mean that people who are subject to immigration procedures would not have a right to know that their data is being processed by another authority. This issue was recently illustrated by the Memorandum of Understanding between the Home Office and NHS Digital3, which saw the NHS providing address, date of birth and GP details to immigration officials. We support Liberty’s campaign on this issue and believe that data sharing schemes allowing the Home Office to access aggregated, sensitive personal data should not be allowed to operate without scrutiny.
The exemption is modelled on existing exemptions for criminal cases. However, people making immigration claims are not criminals, nor are they attempting anything unlawful - they are merely trying to claim their right to remain in the UK. Three million EU citizens may need to assert these rights and should not be treated as if they are criminals. The Bill already contains appropriate exemptions for law enforcement to cover offences such as working illegally, providing false information, or trafficking.
The exemption is so broad that it likely breaches the narrow criteria that the GDPR sets out for such provisions. The restrictions to data protection rights are based on Article 234 of the GDPR which sets out the requirement that "such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society.” The proposed blanket exemption would remove the obligation on the Government to process personal information fairly and transparently, and goes against the fundamental principles of the GDPR. Although the Government claims that the immigration exemption is in the public interest, a blanket exemption is not necessary to achieve this - article 6(3) of the GDPR explains that derogations for public interest should have their own legal basis.
The exemption appears to undermine the following articles in the Charter of Fundamental Rights of the European Union5:
The immigration exemption would affect both data protection rights and the ability of EU citizens in the UK to claim their residency rights. This will effectively go against the promises made in the Prime Minister’s Lancaster House speech about EU citizens’ rights: “the same rules and laws will apply on the day after Brexit as they did before”6. The exemption is certain to face legal challenges and could also endanger any treaty made between the UK and EU. For example, if UK legislation contradicts or undermines EU legislation, the UK is less likely to get a green light from the European Commission for a bespoke deal on continued free exchange of personal data after Brexit7.
The two concessions offered by the Government do not improve the immigration exemption in any way. The right to data portability is designed for consumers to exercise their free choice of services (e.g. changing mobile and broadband providers more easily) and does not generally cover administrative purposes. As such, the Government’s concession allowing immigration subjects to maintain the right to data portability is redundant. Similarly, the right to rectification is likely to prove difficult for people to assert if they cannot access their data in the first place.
Amend the Data Protection Bill to delete Schedule 2 Clause 4.
1) Open Rights Group is a digital rights campaigning organisation. Campaigning for a world where we each control the data our digital lives create, deciding who can use it and how, and where the public’s rights are acknowledged and upheld.
the3million is the largest grassroots organisation of EU citizens in the UK, and campaigns for all EU citizens living here to be able to continue life as usual after Brexit.
2) The Home Office currently has 10% error rate in immigration status checks. https://www.theguardian.com/uk-news/2017/sep/22/home-office-errors-already-leading-to-people-being-denied-bank-accounts