Emily Foster

4 June 2018

Solicitor on the UK Team Zeena Luchowa speaks with Kate Beaumont on the recently enacted update to data protection laws in the UK. The Data Protection Act 2018 provides an exemption to data protection for immigrants, restricting their rights to access personal data held by the Home Office.

Zeena explains how this restriction of an individual’s access to their personal immigration history may have a detrimental impact on access to justice.

Read the full interview below.

[This article was first published on Lexis®PSL Immigration on 4 June 2018]

Examining the exemption for data protection for immigrants

Immigration analysis: Zeena Luchowa, a solicitor in the UK immigration team at Laura Devine Solicitors, says that immigration law is already a web of complex and ever changing rules which individuals are required to navigate to determine how they may enter, remain or confirm their right to be in the UK, and to add to this by restricting an individual’s access to their personal immigration history would have a detrimental impact on access to justice.

What could the exemption for data protection for immigrants mean in practice, and why are immigration practitioners so concerned?
The exemption contained in the Data Protection Act 2018, which came into force on 25 May 2018, restricts the right of individuals to access personal data held by the Home Office where the release of such data is considered as likely to prejudice the maintenance of effective immigration control.

Requests for data, normally made via a subject access request (SAR), have proved essential in challenging incorrect decisions and providing evidence for immigration appeals by migrants whose applications have wrongfully been refused. SARs have played a particularly vital role since the introduction of the ‘hostile environment’ by allowing individuals to obtain proof of their lawful status in the UK, which may have been evidenced by initial entry records such as in the Windrush cases.

The restriction to this right is of huge concern because of its potentially wide application. The term ‘maintenance of effective immigration control’ is unhelpfully broad and is without the necessary and fettered statutory definition to ensure that it is applied in exceptional circumstances rather than as the norm.

Immigration law is already a web of complex and ever-changing rules which individuals are required to navigate to determine how they may enter, remain or confirm their right to be in the UK. To add to this by restricting an individual’s access to their personal immigration history has a detrimental impact on access to justice.

SARs have enabled individuals and their legal representatives to understand a complicated immigration history and prepare applications on the basis of the information on record. It has allowed individuals to scrutinise and challenge Home Office decisions where facts on record have been misrepresented or fundamental mistakes have been made relating to identity or immigration status. It has also proved significant in challenging unlawful detention or for those deprived of nationality. Without such access, erroneous decisions may go unchallenged and individuals with a valid basis to remain in the UK will be without the information to enable them to make an application. Individuals likely to need such data include those who entered as undocumented children, victims of domestic violence and vulnerable individuals, who may have no knowledge of their status in the UK.

What is the context for the introduction of the clause and the government’s explanation for it?
The General Data Protection Regulation (EU) 2016/679 (GDPR) was enacted into UK legislation by the Data Protection Act 2018. The GDPR was intended to standardise data privacy laws across the EU and provide greater protection and control to EU residents over their personal data.

The GDPR provides for a number of very limited restrictions on Member States to individual’s rights under the data protection provisions. These include national security, defence, public security and, more broadly, ‘other important objectives of general interests’ such as an important economic or financial interest.

The government introduced the immigration exemption into UK legislation for the maintenance of effective immigration control, or for the investigation or detection of activities that would undermine it. Specifically, the government has intimated that the exemption is necessary to protect the integrity of the immigration system by, for example, preventing the release of information which would undermine imminent enforcement action.

There has been much opposition to the exemption, particularly in view of the challenges that Windrush generation individuals have faced in the absence of documentation evidencing their lawful basis of stay in the UK. The government has stated that the exemption is intended to apply in limited circumstances, and it should not apply to those lawfully resident or seeking to regularise their status in the UK. However, given the wrongful removals of Windrush migrants despite their lawful status in the UK, it remains to be seen how ‘limited’ this exemption will be in practice and who will be caught by it.

Has the government made any oral/written commitments as to when or how it will be used and/or whether safeguards will be put in place?
The government has stated that it will publish detailed and robust guidance on how the exemption can be used. It is intended to be used in limited circumstances on an individual ‘right-by-right’ basis, rather than as a blanket approach. During the passage of the Bill, it was stated that the restrictions would only bite where there is a real likelihood of prejudice to immigration controls in disclosing the information concerned, and there has to be identifiable evidence of two tests being satisfied. These two tests are:

• that the request is likely to prejudice effective immigration control
• that it is still a live concern

The government anticipates that the exemption will be used in a minority of cases, with a rebuttable assumption that all rights apply to all data subjects.

Individuals can refer a case to the Information Commissioner if they disagree with the way that an exemption has been applied. Ultimately, the Information Tribunal can make a final decision if the case remains in dispute. The Information Commissioner has already raised concerns with the exemption, specifically stating that individuals would be unable ‘to identify any factual inaccuracies’ and it would ‘mean that the system lacks transparency and is fundamentally unfair’.

The government has also committed to reviewing the operation of the exemption in 12 months’ time, and, in the light of experience, narrow the scope of the exemption should it be considered appropriate to do so.

On what grounds could Open Rights Group and the3million challenge the clause if enacted?
The legality of the clause could give rise to a challenge on the basis that the exemption goes further than the limitations expressed under the GDPR by specifically creating an exemption from certain provisions for immigration control reasons. While the UK may consider it to fall under the all-encompassing general interest provision contained in the GDPR, it could still be deemed disproportionate and incompatible with the spirit of fundamental rights and freedoms.

In addition, during the passage of the Bill, many of the examples put forward in favour of the exemption pointed towards an attempt to stop the furtherance of criminal activity, something that has already been provided for under another part of the Act. The need to have this provision, when read with the Act as a whole, may therefore be put to question.

Are there any other points of interest worth mentioning here?
We are yet to see the impact of the exemption in practice and there is currently no published guidance. It will be important to ensure that the guidance is consistent with the commitments put forward by the government. It will also be crucial to monitor how the exemption is being applied in practice so that a challenge can be raised in 12 months’ time to narrow the scope of the exemption in statute to be within the spirit of the GDPR.

Interviewed by Kate Beaumont