Joint Briefing¹: Second Reading of the Data Protection Bill in the House of Commons

The briefing is also available in pdf format.

The Government has introduced the Data Protection Bill with a new exemption to protection of personal data (Schedule 2 Clause 4). The ‘immigration exemptions’ would remove the fundamental right for individuals to access their personal data when it would prejudice “effective immigration controls” or “the investigation or detention of activities that would undermine the maintenance of effective immigration control.”

In practice, this would mean that:

• Foreign residents, including the 3 million EU citizens living in the UK, would lose the right to access and be informed about what data is used about them in immigration cases;
• Foreign residents, including 3 million EU citizens, would lose insight into decisions and errors made by immigration authorities;
• The Home Office could share immigration-related data without restraint or safeguards outside of the EU;
• The Home Office, other government bodies and private sub-contractors would no longer be bound to the general principles of data protection, including “lawfulness, fairness, and transparency” and “integrity and confidentiality”.

The Government claims to have limited the scope of this exemption while the Bill was in the House of Lords. New clauses mean the immigration exemption does not apply to the right to portability and the right to rectification, while the earlier version of the Bill removed all the rights given to data subjects in the EU’s General Data Protection Regulation (GDPR). However, these changes are cosmetic and will not reduce the negative impact of the measures, as rectification requires having access to the data and portability generally does not apply to public authorities.
                
The Open Rights Group and the3million still have serious concerns about the current version of the immigration exemption (Schedule 2 Clause 4) and the consequences of passing the Bill with this exemption for millions of EU citizens in the UK.  We therefore urge you to amend the Data Protection Bill to delete the immigration exemption in Schedule 2 Clause 4.

Our outstanding concerns are:    

1. The exemption would remove fundamental rights to privacy, data protection, due process, equality and non-discrimination of millions of EU citizens in the UK and other foreign residents. We are concerned that unfair and opaque decisions could be made about people, and data could be held or shared without sufficient security and confidentiality.
2. The exemption treats all migrants going through immigration processes as potential criminals – it aims to ensure that ‘investigations’ are not ‘endangered’ through releasing data to wrongdoers. The reality is that most immigration procedures are not criminal but administrative matters, and data protection is needed to check the power of public authorities.
3. The blanket exemption seems to conflict with the provisions in the EU’s General Data Protection Regulation (GDPR) to protect rights and fundamental data protection principles. This may be a point of contention in the EU/UK negotiations on the Withdrawal Agreement, and may affect the ability of the UK to secure a deal with the EU on continuing free transfers of data.

Rights of EU citizens

Discrimination:

The immigration exemption is a blanket exemption, potentially affecting all foreigners involved in immigration cases and their families. The Bill is being introduced as EU citizens face a new process proposed by the UK government, requiring them to apply for “settled status” after Brexit. We are concerned that this creates a two-tier data protection system, where EU citizens and other migrants effectively have fewer rights to access their personal data than British citizens.

Access to justice:

Individuals involved in migration disputes would not have the right to obtain their personal information from the Home Office. This is the most basic requirement to be able to handle an administrative dispute. Immigration lawyers routinely use Subject Access Requests to obtain information about clients from the Home Office, and the immigration exemption will make it harder for them to represent their clients effectively – for example, where applications are refused due to an error, or if a client is making an appeal against a Home Office decision. This is a serious concern given the 10% error rate² in immigration status checks, and particular errors including deportation letters sent to lawful European residents. 


Right to know:

The proposed restrictions of subject rights would mean that people who are subject to immigration procedures would not have a right to know that their data is being processed by another authority. This issue was recently illustrated by the Memorandum of Understanding between the Home Office and NHS Digital³, which saw the NHS providing address, date of birth and GP details to immigration officials. We support Liberty’s campaign on this issue and believe that data sharing schemes allowing the Home Office to access aggregated, sensitive personal data should not be allowed to operate without scrutiny.

Criminalisation of immigrants

The exemption is modelled on existing exemptions for criminal cases. However, people making immigration claims are not criminals, nor are they attempting anything unlawful – they are merely trying to claim their right to remain in the UK. Three million EU citizens may need to assert these rights and should not be treated as if they are criminals. The Bill already contains appropriate exemptions for law enforcement to cover offences such as working illegally, providing false information, or trafficking.

Incompatibility with EU law

Undermines the GDPR:

The exemption is so broad that it likely breaches the narrow criteria that the GDPR sets out for such provisions. The restrictions to data protection rights are based on Article 23⁴ of the GDPR which sets out the requirement that “such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society.” The proposed blanket exemption would remove the obligation on the Government to process personal information fairly and transparently, and goes against the fundamental principles of the GDPR. Although the Government claims that the immigration exemption is in the public interest, a blanket exemption is not necessary to achieve this – article 6(3) of the GDPR explains that derogations for public interest should have their own legal basis.

Undermines the Charter:

The exemption appears to undermine the following articles in the Charter of Fundamental Rights of the European Union⁵:

• Article 8 granting protection of personal data,
• Article 20 providing for equality before the law, and
• Article 21 on non-discrimination.

Brexit negotiations and future treaties

The immigration exemption would affect both data protection rights and the ability of EU citizens in the UK to claim their residency rights. This will effectively go against the promises made in the Prime Minister’s Lancaster House speech about EU citizens’ rights: “the same rules and laws will apply on the day after Brexit as they did before”⁶. The exemption is certain to face legal challenges and could also endanger any treaty made between the UK and EU. For example, if UK legislation contradicts or undermines EU legislation, the UK is less likely to get a green light from the European Commission for a bespoke deal on continued free exchange of personal data after Brexit⁷.

Rights to portability and rectification do not fix the exemption

The two concessions offered by the Government do not improve the immigration exemption in any way. The right to data portability is designed for consumers to exercise their free choice of services (e.g. changing mobile and broadband providers more easily) and does not generally cover administrative purposes. As such, the Government’s concession allowing immigration subjects to maintain the right to data portability is redundant. Similarly, the right to rectification is likely to prove difficult for people to assert if they cannot access their data in the first place.

Solution:

Amend the Data Protection Bill to delete Schedule 2 Clause 4.

1) Open Rights Group is a digital rights campaigning organisation. Campaigning for a world where we each control the data our digital lives create, deciding who can use it and how, and where the public’s rights are acknowledged and upheld.

the3million is the largest grassroots organisation of EU citizens in the UK, and campaigns for all EU citizens living here to be able to continue life as usual after Brexit.

2) The Home Office currently has 10% error rate in immigration status checks. https://www.theguardian.com/uk-news/2017/sep/22/home-office-errors-already-leading-to-people-being-denied-bank-accounts

3) https://www.theguardian.com/society/2018/jan/31/nhs-chiefs-stop-patient-data-immigration-officials

4) https://gdpr-info.eu/art-23-gdpr/

5) http://www.europarl.europa.eu/charter/pdf/text_en.pdf

6) https://www.gov.uk/government/speeches/the-governments-negotiating-objectives-for-exiting-the-eu-pm-speech

7) https://amp.ft.com/content/f4d8364c-88c0-11e7-bf50-e1c239b45787