In 2018, the UK adopted new data protection legislation (the Data Protection Act 2018) to implement the EU’s General Data Protection Regulation (GDPR), which is aimed at giving people more control over their personal data.
On 23 and 24 July 2019, the High Court of Justice in London heard a legal challenge against an exemption in the UK’s new data protection legislation. The exemption allows data controllers, including public bodies (such as the Home Office) and private bodies (such as employers or private landlords) to set aside the EU’s GDPR and refuse or restrict access to personal data held about individuals if releasing the information would “prejudice effective immigration control”. The legal challenge revealed that the UK Government has used this controversial exemption in response to 60% of its immigration-related data requests since the beginning of 2019. As a result, data subjects were denied access to some or all of their data. It was also confirmed that individuals were not being informed when the exemption is applied.
Under the immigration exemption, some data rights are removed where data are processed in the name of “effective immigration control” or are judged likely to prejudice that
The Open Rights Group (a digital campaigning organisation) and the3million (a campaign organisation for EU27 citizens in the UK), who brought the challenge, argue that this “immigration exemption” amounts to an “unlawful, unnecessary and disproportionate interference with fundamental data protection rights”. They fear that, by refusing access to data, Home Office errors will go unchecked and important decisions about an individual’s immigration status could be made on the basis of incorrect or incomplete information. The Open Rights Group press releases on the challenge are available here and here.
The High Court hearings follow a formal complaint to the European Commission against the UK in relation to the immigration exemption, submitted in early July 2019 by the Platform for International Cooperation on Undocumented Migrants (PICUM) (supported by various migrant and digital rights groups). PICUM said that the exemption “carves out a space where public and private actors have wide discretion to access, use, share, and gather personal data, without the knowledge of affected individuals and with virtually no accountability.” The exemption also fails to include safeguards for sensitive data or vulnerable groups like children and “risks worsening existing violations of fundamental rights and freedoms, under the UK’s “hostile environment” policy.” PICUM’s statement is available here.
As long as the UK is an EU Member State, the European Commission has the right to request information from, and ultimately bring a case against, the UK before the Court of Justice of the EU in Luxembourg, if it concludes that the UK’s data protection legislation breaches EU law. But even post-Brexit, the EU is likely to expect the UK to maintain data protection laws that are up to the EU’s standards if it wants to continue to trade with the EU.
The immigration exemption affects everyone involved in an immigration case.