Victory for migrants as judge rules immigration exemption is incompatible with GDPR

A High Court judge has agreed with Open Rights Group and the3million that the immigration exemption in the UK Data Protection Act 2018 is incompatible with General Data Protection Regulation (GDPR).

It is the second time that ORG and the3million have taken the government to court over the immigration exemption, which allows the Home Office and private companies to refuse requests by individuals for access to personal data held about them on the grounds that it might “prejudice the maintenance of effective immigration control”. This denial can cause life-changing harms by preventing migrants from being able to challenge mistakes in the data that is held about them, and therefore being unable to effectively challenge immigration decisions. For example, an asylum-seeker who has been refused by the Home Office needs access to their personal data to effectively lodge an appeal. Application of the immigration exemption, and the withdrawal of that access, could result in genuine asylum-seekers being deported back to countries where they face a real risk of persecution and serious harm.

Today, the High Court agreed with the3million and ORG that the immigration exemption contained within Schedule 2 of the Data Protection Act 2018 is incompatible with Article 23 of the UK GDPR. The ruling is a victory for migrants’ data rights in an increasingly hostile environment in the UK, where migrants are treated as second class citizens. It also represents another instance of this government trying to chip away at the whole human rights framework post-Brexit.

Background to the case

The exemption was first legally challenged by the3million and the Open Rights Group in 2018 and resulted in a Court of Appeal ruling that meant the Government had to amend defects in the exemption last year. Judges said it did not meet the safeguarding requirements for exemptions listed in the GDPR.

The Government laid a statutory instrument which it claimed remedied the defects but the3million and the Open Rights Group disagreed and applied for a second judicial review, which took place in the High Court on Tuesday 21 March.

This is because it does not meet the requirement of being a ‘legislative measure’ necessary for compliance with Article 23 of the UK GDPR; and it does not comply with the mandatory requirements listed in Article 23 of the UK GDPR and, as a result, omits necessary substantive and procedural safeguards.

The Information Commissioner was an Interested Party in the claim and they made the point that the amendments to the legislation do not do enough to bring the exemption into compliance with the GDPR.
 
Meg Foulkes, Head of Policy and Litigation at Open Rights Group, said:

“We shouldn’t have had to take the Government to court again but we’re delighted that a judge has agreed with us for the second time.

The Government must now ensure that the Home Office and private companies that are contracted to enforce immigration control comply with GDPR. The data they process can lead to life-altering decisions and it’s vital that the system is fair and transparent.

The Government’s refusal to address this the first time round shows that their priority seems to be maintaining the digital hostile environment rather than complying with data protection legislation.”

The 3million and Open Rights Group were represented by Leigh Day lawyer Erin Alcock.

Counsel instructed to appear in the case on behalf of the campaigners were Ben Jaffey KC of Blackstone Chambers and Nikolaus Grubeck of Monckton Chambers.