Immigration Bill

Written evidence submitted by the Information Commissioner’s Office (IB 62)

The Immigration Bill (HC Bill 110)

Introduction

1. The Information Commissioner has responsibility for promoting and enforcing the Data Protection Act 1998 (DPA), the Freedom of Information Act 2000, the Environmental Information Regulations and the Privacy and Electronic Communications Regulations 2003. I am independent from government and uphold information rights in the public interest, promote openness by public bodies and data privacy for individuals.

2. Much of the data which will be processed as a result of these proposals in the Immigration Bill will be personal data. Furthermore, a significant amount of this data is likely to be sensitive personal data and this is afforded a higher level of protection under the DPA. Appropriate safeguards will need to be in place to ensure that any processing of personal data is compliant with the DPA.

3. It is unfortunate that my staff has not had the opportunity to engage with Home Office officials on the proposals as, due to the lack of consultation, it is difficult to understand how some of these proposals will work in practice. I have already responded to the consultation on tackling illegal immigration in privately rented accommodation and I am happy to work with involved parties, including our existing contacts at the Home Office, to provide insight into the DPA and the privacy implications of the proposed regime.

Privacy Impact Assessment

4. It is good practice to undertake a Privacy Impact Assessment (PIA) prior to the introduction of any initiative involving the processing of personal data. The Cabinet Office has recommended that all government departments should undertake a PIA on new initiatives involving personal data and as far as I am aware one has not been undertaken in terms of the proposals outlined in this Bill.

5. The purpose for any sharing or disclosure of personal data needs to be clear. The legislation is designed to tackle illegal immigration and also the problem of rogue landlords. It is important that systems where personal data is being processed are designed so that specified purposes are fulfilled. This can be identified through a PIA.

6. There are risks where information starts being shared for a number of purposes. Unless purposes and processes are clearly planned in the early stages, there is a real risk that data controllers will fail to fulfil their legal obligations to the DPA.

7. I am also concerned that proposals could lead to landlords or their intermediaries recording information about prospective tenants which could lead to the creation of a blacklisting database.

8. As a general point, the supervisory regime is unclear.

Biometrics

9. It is acknowledged that the use of biometrics can be important in terms of verifying identification, ensuring the accuracy of data being processed and, further, can be privacy enhancing in certain circumstances. I gather that there is an evidential base that demonstrates that this approach reduces the volume of fraudulent visa applications and furthermore should assist with verifying identity within the immigration process. That said, any use of biometrics needs to be proportionate to the problem it is trying to resolve and it needs to be demonstrated that there is a pressing social need to justify their use.

10. Any requirement to hold biometric information should accord with the DPA in that it should not be kept for longer than required for its purpose; responsibility for its processing should be clearly established and formal agreements should be in place if it is being shared.

11. Although I would not ordinarily support a blanket retention period I am concerned that the removal of the statutory maximum ten year time limit for retention of biometric data could mean that information is kept for longer than it would be now and there is therefore a risk of non-compliance with the DPA which requires that personal data shall not be kept for longer than is necessary to fulfil its purposes. It is my understanding that retention of biometric data should only apply to those individuals who are subject to immigration controls. It is not clear how this would be defined in practice. Any Regulations will need to ensure that effective safeguards are in place to ensure that biometric data is not kept for longer than necessary. Where additional biometric information is retained, it will be important to consider whether any compensatory safeguards could be implemented such as deleting other personal data that is no longer required.

12. A database is referred to in the legislation. The role of this database within the mechanisms of the immigration process is not clear. It would need to have safeguards in place in order to ensure that it is compliant with the principles of the DPA.

Access to services

13. I note from the recently published House of Commons Select Committee report on the work of the UK Border Agency that the status of the backlog on in-country immigration applications remains significant. The consequences of this position upon the proposed legislation engage concerns about data quality and fairness particularly when the potential for detriment to individuals is considerable.

14. In order to fulfil their legal obligation under the DPA, landlords will need to be registered as data controllers and ensure that they are compliant with the data protection principles (although in most cases the role of landlord would require this anyway). This arrangement could become complex if, for example, the landlord employs a letting agent. Either way, each party needs to understand their responsibilities with regard to the processing of personal data. I am aware that a code of practice has been drafted for the housing sector, but I am not aware of a similar document for the NHS or other sectors covered by the Bill. It would be advisable to refer to data protection obligations in code of practice that are being drawn up to support this legislation. My staff could offer advice to this area of activity.

Future liaison

15. I see that the practical implications of the Immigration Bill are being debated in general committee and I would welcome the opportunity for the concerns I have raised here to be reviewed at this forum or through alternative channels.

November 2013