Judge rules that Immigration Exemption in Data Protection Act is still unlawful

In a judgment handed down this morning, a High Court judge declared that the immigration exemption written into Schedule 2 of the Data Protection Act 2018 is incompatible with retained EU law in that it does not satisfy the requirements of Article 23 of the UK General Data Protection Regulations (GDPR).

The judgment states: “The cure is straightforward: the measures to satisfy the relevant provisions of Article 23(2) need to be set out in either legislation, or a code endorsed by Parliament, with binding legal effect in domestic law. An obligation to merely “have regard to” a code or policy will not do. That is the price under the UK GDPR regime for using the derogation.”

The judgment notes that the use of the Immigration Exemption by the Home Office has been extensive. Campaigners believe that the exemption may have been used to date, for example, to refuse requests made by individuals for access to personal data held about them.

The Home Office claims the exemption is necessary to avoid any prejudice to the maintenance of effective immigration control arising from an individual exercising their rights under data protection legislation. However, in today’s judgment, the Court noted that the Government’s evidence showed a lack of appreciation of the particular vulnerabilities of those who are likely to be caught by the exemption, and that the extensive use of the exemption underscored the need for particularly clear and precise safeguards.

Today’s judgment follows a second judicial review challenge to the lawfulness of the Exemption.

Last year a judicial review challenge by the3million and the Open Rights Group resulted in the Government amending defects after judges said the exemption did not meet the safeguarding requirements for exemptions listed in the General Data Protection Regulation.

However the3million and the Open Rights Group believed the changes were not enough to protect people subject to immigration laws and applied for a second judicial review.

The Information Commissioner was an Interested Party in the claim and said the amendments to the legislation did not go far enough to bring the exemption into compliance with the GDPR.

The ruling today means that the exemption is declared unlawful, however the Court has suspended that declaration for three months to allow the Government time to amend the Data Protection Act so as to remedy the incompatibility with the GDPR.

Monique Hawkins, Interim Co-CEO of the3million said:

“We are delighted the Court agrees with our assessment that the Government has - yet again – failed to protect migrants’ rights to data protection. It is extraordinary that we have to challenge the government in order to gain clear and legally enforceable safeguards, after the Court of Appeal already previously told it to do so. This judgment will bring us a step forward towards a fairer and more transparent immigration system."

Meg Foulkes, Head of Policy and Litigation at Open Rights Group, said:

“We shouldn’t have had to take the Government to court again but we are delighted that a judge has agreed with us for the second time.
“The Government must now ensure that the Home Office and any private companies that are contracted to enforce immigration control comply with GDPR. The data they process can lead to life-altering decisions and it’s vital that the system is fair and transparent.
“The Government’s refusal to address this the first time round shows that their priority seems to be maintaining the digital hostile environment rather than complying with data protection legislation.”

the3million and Open Rights Group are represented by Leigh Day partner Waleed Sheikh and lawyer Erin Alcock.

Erin Alcock said:

“Our clients are delighted with the Court’s judgment. Many people subject to immigration control are highly vulnerable and it is crucial their fundamental rights are safeguarded, something which has been recognised in the ruling today.”

Counsel instructed on behalf of the campaigners were Ben Jaffey KC of Blackstone Chambers and Nikolaus Grubeck of Monckton Chambers.