Court Rules Immigration Exemption to Data Protection ‘Unlawful’

On Monday, the Court of Appeal ruled that the Immigration Exemption in the Data Protection Act 2018 is unlawful, and gave the Government three months to change the legislation.

Under the Data Protection Act 2018, people in the UK are granted increased control over their personal data. The Act makes accessing information held about them, often done through Subject Access Requests (SARs), a fundamental right. Through this access, individuals can rectify, erase, and object to the processing of their data.

The Immigration Exemption was specifically devised to curtail these rights when the Home Secretary deems them obstructive to “effective immigration control”. While the government is allowed to create exemptions to data protection rights, safeguards and provisions must be set out in legislation.

The legal challenge against the Immigration Exemption was brought forth by campaign group the3million, an organisation of EU citizens in the UK. It argued that the existing safeguards are inadequate, and the risks involved are not adequately considered. Additionally, these provisions have not been explicitly detailed within the legislation. Instead, the Home Office had proposed the inclusion of relevant safeguards within a separate policy document, a document susceptible to immediate alteration by ministers without parliamentary scrutiny.

The Immigration Exception was deemed unlawful in a previous judgment, which the Home Office appealed. Now, that appeal has been rejected.

‘Sidestepping Parliamentary Scrutiny’

In Monday’s ruling, the three Court of Appeal judges ruled that the safeguards were insufficient, and that they had to be set out in legislation.

“In essence, what the Secretary of State is saying to Parliament is that there will be additional safeguards but is not willing to tell Parliament what they are. They will be set out in another document, which the Secretary of State can change at will,” the judgment reads. The Cout of Appeal thus confirmed an earlier ruling that the Immigration Exemption is incompatible with the Data Protection Act 2018, and gave the government three months to make the required changes.

Monique Hawkins, Co-CEO of the3million, said, “It’s shameful how this government is fighting tooth and nail to deny migrants our fundamental data rights, sidestepping parliamentary scrutiny. We suspect the Home Office use the Exemption especially to justify data transfers abroad, large scale processing and profiling exercises.

“We expect that the government will drag its feet to try and delay giving effect to this judgment until its new Data Protection and Digital Information Bill becomes law, by which point everyone’s rights will have been weakened. Automated processing and profiling will be made easier, with reduced scrutiny from both Parliament and the Information Commissioner’s Office.

“This shows us how far this government will go, wasting public money to fight against being transparent and accountable to parliament.”

Do you want to keep up to date? If so, browse our other articles here.