Letter to EU Commissioners: Concern over United Kingdom’s proposed ‘immigration exemptions’ from Data Protection Bill

Concern over United Kingdom’s proposed ‘immigration exemptions’ from Data Protection Bill

Dear Frans Timmermans, Věra Jourová, and Tiina Astola

We, the undersigned, write to express our concern regarding the UK Government’s incorporation of the General Data Protection Regulation into domestic law. Setting aside other areas of concern, the UK’s Data Protection Bill proposes an exemption that would remove individuals’ fundamental right to data protection if it is likely to prejudice “effective immigration control”.

This proposed exemption (‘the immigration exemptions’) will remove the right of individuals to receive information from a subject access request: a core mechanism in any immigration dispute. Further restrictions would remove the government’s responsibility to process an individual’s data in accordance with the principles of data protection including lawful, fair and transparent processing. The exemption would allow data to be shared across UK government institutions without accountability or opportunity for recourse.

The immigration exemptions would potentially leave EU citizens applying for residency post- Brexit without access to their personal data at the most crucial time. As a result, decisions taken about a person’s right to remain which may be based on incorrect information would not be rectified, because individuals would be unable to see that the personal data held is incorrect.

EU citizens could be mistakenly forced to leave the United Kingdom as a result of the immigration exemptions.

Further, the proposed immigration exemptions would appear to violate both the General Data Protection Regulation and the Charter of Fundamental Rights:
- The General Data Protection Regulation Article 23(1) stipulates that any restrictions under
the clause must “respect the essence of the fundamental rights and freedoms and [must be] a necessary and proportionate measure in a democratic society...”.

- Under Article 8 of the Charter of Fundamental Rights every individual in the European Union is entitled to the protection of personal data concerning him or her. This includes the right of access to data which has been collected concerning him or her, and the right to have it rectified.

The blanket immigration exemptions go beyond the necessity and proportionality of restrictions under Article 23 of the GDPR and directly interfere with an individual’s right of access to data, and for their data to be processed fairly under Article 8 of the Charter of Fundamental Rights.

We are concerned about the potential impact the immigration exemptions will have on the United Kingdom’s adequacy when it leaves the European Union. The judgment by the Court of Justice of the European Union in Maximillian Schrems v. Data Protection Commissioner C- 362/14, lays out at para 74 in no uncertain terms, that the practical requirement for adequacy requires:

“...protection essentially equivalent to that guaranteed within the European Union.”

And at para. 95:

“Legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter.”

Each of you represent an institution which holds a mandate to protect the interests of EU citizens and uphold the Charter of Fundamental Rights. That mandate includes the respect of these rights by member states.

We believe these proposed exemptions are particularly significant to all EU citizens currently resident in the United Kingdom in maintaining the protection of rights guaranteed to them in the Charter of Fundamental Rights.

We call on you:

- to communicate to the United Kingdom that the immigration exemptions must be removed to secure the compatibility with the essence of the fundamental right to data protection, and the Charter of Fundamental Rights; and

- to examine the exemptions impact on EU citizens’ ability to enforce their residency rights after Brexit under the agreements currently being brokered.

Yours sincerely,

Douwe Korff, Emeritus Professor of International Law, London Metropolitan University and Associate, Oxford Martin School of the University of Oxford

Judith Rauhofer, Lecturer in IT Law, University of Edinburgh

Dr Andrew A. Adams, Deputy Director, Centre for Business Information Ethics, Meiji University, Tokyo, Japan

Anna Fielder, Trustee and Chair Emeritus, Privacy International

Mike O’Neill, Director, Baycloud Systems, The Oxford Centre for Innovation

Marie Georges, Independent expert and member of the FREE Group

Prof Andy Phippen, University of Plymouth

Dr Reuben Binns, Department of Computer Science, University of Oxford

Dr Robin Callender Smith, Professor of Media Law, QMUL Information Rights Judge and former Immigration Judge

Dr Paul Bernal, Senior Lecturer in IT, IP and Media Law, University of East Anglia Law School Milena Popova, Digital Cultures Research Centre, UWE Bristol

Dr. Maureen O. Mapp, Lecturer and Module leader for Cyberlaw, University of Birmingham Law School

Dr Duncan Campbell, Visiting Senior Fellow (Law and Sociology), University of Sussex

Dr. Nicholas J. Gervassis, Lecturer in Law, University of Plymouth

Damian Tambini, Associate Professor, London School of Economics

Dr Sally Broughton Micova, Lecturer in Communications Policy and Politics, University of East Anglia

Vian Bakir, Professor in Political Community and Journalism, Bangor University

Ray Corrigan, Senior Lecturer, Science Technology Engineering & Mathematics Faculty, The Open University

Lilian Edwards, Professor of E-Governance, Law School, Strathclyde University Marian Petre, Professor of Computing, The Open University

Blaine Price, Professor of Computing, The Open University

Andrew McStay, Professor of Digital Life, Bangor University

Marian Petre, Professor of Computing, The Open University 

Milena Popova, Digital Cultures Research Centre, UWE Bristol

Note: This letter was sent in copy to Guy Verhofstadt, chief Brexit representative of the European Parliament, and the European Data Protection Supervisor.