What is at stake with the immigration exemption legal challenge?

The immigration exemption in the Data Protection Act 2018 will remove key data protection rights for everyone in the United Kingdom. Some may think that because we’re talking immigration we’re talking about asylum seekers, refugees, or immigrants. But they’d be wrong. The law is so broad, and touches on so many parts of our deeply interconnected lives, that it is likely to affect everyone’s rights.

From May to July 2018, Open Rights Group and the3million, the grassroots organisation for EU citizens living in the United Kingdom, successfully crowdfunded for a legal challenge against the immigration exemption in the Data Protection 2018. That is thanks to everyone who donated, shared, tweeted and wrote articles in support of the challenge. Now the groups are moving towards the next stage of challenge, it is important to reiterate what we are challenging and why we are challenging it.

The immigration exemption in the Data Protection Act 2018, under Schedule 2, Part 1, para 4 would remove fundamental data subject rights if the data controller thinks the disclosure of that data would “prejudice” “the maintenance of effective immigration control”, or “the investigation or detection of activities that would undermine the maintenance of effective immigration control”.

In a simple sense, if someone contacts an organisation to get a copy of their personal data held about them, that organisation doesn’t have to provide it if, they argue, it would “prejudice” “effective immigration control”.

But this is about way more than access to data.

Not only does it remove important rights for individuals, it also removes important responsibilities that bodies owe everyone. And further, it removes restrictions from sharing of data between bodies; a shadowy, opaque, pernicious problem.

Some of the characterisation of the challenge is that it is solely about access to data, or subject access rights to give its Data Protection title. Although that is an important part of it, it is about more than knowing whether you have been treated fairly and lawfully. The challenge is about people being treated fairly and lawfully, period.

We are all granted the fundamental right to data protection under Article 7 of the Charter of Fundamental Rights of the European Union. This right is explicit about access to data, and also the right to rectify that data. Under the General Data Protection Regulation (GDPR) we also have rights:

• to restrict processing;

• to object to the processing;

• to erasure; and

• to be provided information about what our data will be used for when it is collected from us.

Each of these rights, either explicitly, or practically would be exempted if a data controller decided disclosure would “prejudice” “effective immigration control”.

The challenge from ORG and the3million is for the removal of the immigration exemption in its entirety. The exemption is a blunt instrument, affecting the rights of potentially millions: EU citizens, non-EU citizens, even British nationals, due to the clear as mud term “immigration control” and handing the power to exercise this exemption to all data controllers.

The term “immigration control” isn’t defined. Does it mean any criminal act such as overstaying a visa? Maybe. Does it mean routine checking up of a person’s immigration status? Perhaps. Will the exemption be applied against the routine or the exceptional? Unclear, and political promises mean nothing when the letter of law is this vague.

This imprecision does not help when you consider who is going to have the power to apply the exemption. The exemption is not limited to UK Border Force, or Passport Office, or Immigration Enforcement. It is any data controller. That could mean the private contractors like G4S and Serco that are running immigration detention centres. But it could also mean the NHS, your local authority, your school, your landlords and up until recently banks and building societies. These could all potentially rely on or operate some part of the immigration exemption.

Circling the lack of precision in “immigration control” and the non-exhaustive list of who could apply the exemption is the lifting of restrictions and responsibilities to data sharing.

Previously, immigration data sharing initiatives from the education sector and the NHS have been criticised for betraying the trust of individuals accessing these services. Under the immigration exemption, the responsibility to confirm data sharing has been removed from controllers if it would “prejudice” “effective immigration control”. No more acknowledgement of these data sharing initiatives between the NHS or schools and the immigration enforcement system. 

Each of these data controllers owe obligations to us as data subjects when they process our data. They need to process our data fairly, lawfully, and transparently. They also need to make sure it is adequate and relevant. They must process only what is necessary for the purpose they collected the information. They even have to ensure appropriate security of the personal data. All of this is a responsibility they have to us as controllers of our data. All of these can be exempted if to respect these responsibilities would be to undermine the restriction of our rights.

Due to the imprecise nature of the term, who might apply it, the freewheeling data sharing and the lifting of pesky responsibilities to protect people’s data, the exemption could affect far more people than just those going through an immigration process. You could be a British national married to an EU or non-EU citizen for instance. Your data tied up in your marriage could be shared with others without your knowledge because to allow you to know would “prejudice” “effective immigration control”. Or maybe your child is in school, maybe you’re just travelling and your data is being used to profile you against other travellers. The exemption is so wide it doesn’t draw a narrow box, it is a big carve out.

Everyone is entitled to the protection of their personal data. Everyone’s right is threatened by the broad immigration exemption.

Open Rights Group and the3million are challenging all of the exemption, for everyone.