Second legal challenge to Immigration Exemption in Data Protection Act 2018

The “immigration exemption”, in the Data Protection Act 2018, was ruled unlawful by the Court of Appeal in June 2021 following a challenge brought by Open Rights Group and the3million.

The exemption, in Schedule 2 of the Data Protection Act, has been used by the Home Office and private companies working to control immigration to refuse requests by individuals for access to personal data held about them on the grounds that it might “prejudice the maintenance of effective immigration control”. Precisely how widespread the usage of the exemption is remains unclear. 
 
Judges gave the government until 31 January 2022 to correct the defects in the exemption. They said in their ruling that it did not meet the safeguarding requirements for exemptions listed in General Data Protection Regulations (GDPR). On 26 January 2022 the government laid a statutory instrument to amend the immigration exemption which it claimed remedied the defects.
 
However, Open Rights Group (ORG) and the3million, which represents EU citizens living in the UK, claim that the exemption is still unlawful and have applied for a second judicial review of the policy, in the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022.
 
The claimants, again represented by the human rights legal team at law firm Leigh Day, argue the exemption is still unlawful because it does not meet the requirements of being a ‘legislative measure’ necessary for compliance with Article 23 of the UK GDPR and omits necessary and procedural safeguards required by Article 23.
 
A legislative measure must be published in full, whereas the statutory instrument allows the Home Secretary to publish the exemption in a redacted format, which infringes the fundamental principle of legal certainty and does not fulfil the requirement to publish in full.
Contrary to the Court of Appeal ruling, the revised exemption is still “non-binding” guidance. 
 
The parts of the exemption which justify restricted access to data for the vague purpose of “immigration control” have been left unamended. The exemption does not clearly and precisely ensure that the requirements of necessity and proportionality are met and does not contain specific provisions required by Article 23.
 
On 15 June 2022 the ORG and the3million were granted permission to proceed to a full hearing later this year.
 
Erin Alcock, lawyer in the human rights team at Leigh Day said: 
 
“The Court of Appeal ruling last year was very clear about the safeguards required to bring the Immigration Exemption into compliance with the GDPR. It is disappointing that the statutory instrument laid falls short of what is expected by the law. Our clients felt they had no choice but to take the matter back to court for a second review and are delighted that the High Court has now granted them permission to do so.”  
 
Luke Piper, Head of Policy and Advocacy at the3million said:
 
“We are pleased that permission has been granted so that this important matter can be considered by the court. We had hoped, after the first challenge, the UK Government would do the right thing and do away with the immigration exemption that denies people their basic data rights. Instead, we are back in court pursuing the safeguards we and every person living in the UK is entitled to.”
 
Meg Foulkes, Head of Policy and Litigation at Open Rights Group, said:
 
“The Court of Appeal made clear what was necessary to put this matter right. The government’s failure to properly comply with these directions means that yet again, we are fighting to ensure that data rights are respected. We remain committed to holding this government to account.”
 
Ben Jaffey QC of Blackstone Chambers and Julianne Morrison and Nikolaus Grubeck of Monckton Chambers are advising in this matter.