020 7650 1200

Data Security

Appeal Court rules that Immigration Exemption in Data Protection Act is still unlawful

The Court of Appeal has ruled that the Immigration Exemption in the Data Protection Act 2018 is still unlawful despite the Government’s bid to prove that latest measures to bring it in line with safeguarding requirements listed in regulations are enough.

Posted on 18 December 2023

The Government appealed a High Court ruling given in March 2023 that the Immigration Exemption in Schedule 2 of the Data Protection Act 2018 is incompatible with retained EU law. Judges said the exemption does not satisfy the requirements of Article 23 of the UK General Data Protection Regulations (GDPR).

The Appeal Court dismissed the Government’s appeal, highlighting three fundamental principles that needed to be heeded:

A need for specific provisions rather than general principles of human rights law, the need for binding rules of law rather than simply policies, and the need for Parliamentary scrutiny and approval of safeguards.

The judgment states: “If, for example, the safeguards could simply be contained in a policy document . . . those safeguards could be amended or even abrogated subsequently without the need for the Executive to return to Parliament for its approval. This is the fundamental reason why I believe that the Judge was correct in his conclusion that the Immigration Exemption does not comply with the requirements of the UK GDPR.”

The judgment in March followed a second judicial review challenge to the lawfulness of the Exemption.

Last year a judicial review challenge by the3million and the Open Rights Group resulted in the Government amending defects after judges said the exemption did not meet the safeguarding requirements for exemptions listed in the General Data Protection Regulation.

However, the3million and the Open Rights Group believed the changes were not enough to protect people subject to immigration laws and applied for a second judicial review.

The Information Commissioner was an Interested Party in the claim and said the amendments to the legislation did not go far enough to bring the exemption into compliance with the GDPR.

The ruling today means that the exemption is confirmed as unlawful.

the3million and Open Rights Group are represented by Leigh Day partner Waleed Sheikh and lawyer Erin Alcock.

Erin Alcock said:

“Many people subject to immigration control are highly vulnerable and it is crucial their fundamental rights are safeguarded. The judgment of the Court of Appeal acknowledges the important role of Parliament in this context – to provide the democratic scrutiny that is necessary in circumstances where fundamental rights are at risk. Our clients welcome the judgment of the Court of Appeal today, upholding the High Court decision from earlier this year, declaring the Immigration Exemption in its current form to be unlawful.”

Counsel instructed on behalf of the campaigners were Ben Jaffey KC of Blackstone Chambers and Nikolaus Grubeck of Monckton Chambers.

Waleed Sheik
Human rights Judicial review

Waleed Sheikh

Waleed Sheikh is a partner in the human rights department.

Erin Alcock
Human rights Judicial review

Erin Alcock

Erin is an associate in the human rights team

News Article
Hacker Data Breach
Data breach Human rights Afghanistan

Afghan national’s lawyer welcomes Ministry of Defence fine for “particularly egregious” data breach of Afghan nationals’ personal data

The Information Commissioner’s Office, the independent body responsible for upholding information rights and data privacy, has fined the Ministry of Defence £350,000 for disclosing personal information of 265 Afghan nationals seeking relocation to the UK shortly after the Taliban took control of Afghanistan in 2021. The ICO found that “the egregious breach let down those to whom our country owes so much” and that the error could have resulted in a threat to life.