Data Protection Bill

Written evidence submitted by Amnesty International UK (DPB22)

Amnesty International UK is a national section of a global movement. Collectively, our vision is of a world in which every person enjoys all of the human rights enshrined in the Universal Declaration of Human Rights and other international human rights instruments. Our mission is to undertake research and action focused on preventing and ending grave abuses of these rights. We are independent of any government, political ideology, economic interest or religion.


1. In this submission, Amnesty International UK (AIUK) focuses on the ‘immigration exemption’ to data protections provided at paragraph 4 of Schedule 2 to the Bill.

2. That we do not focus on other aspects of the Bill should not be taken as implying that we do not or would not have any human rights concerns regarding other aspects of this Bill. The immigration exemption nonetheless demands specific consideration given the extraordinary breadth in the way it is framed and the impact it would have.

3. In very short summary, the exemption would mean that several basic protections against improper, inaccurate and harmful use of data would not apply where it was said that applying the protections could in some way prejudice ‘effective immigration control’.

4. For reasons given in this submission, AIUK supports Amendment 156 in the names of the Rt Hon Liam Byrne MP, Louise Haigh MP, Chris Elmore MP and Darren Jones MP to remove this exemption.

The relevant provisions of the Bill:

5. Clause 15 of the Bill is to give effect to Schedule 2. Subparagraph (2) of that clause states:

"In Schedule 2 –

(a) Part 1 makes provision adapting or restricting the application of rules contained in Articles 13 to 21 of the GDPR in specified circumstances, as allowed for by Article 6(3) and Article 23(1) of the GDPR;..."

6. The meaning of GDPR is given at clause 3(10):

"‘The GDPR’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)."

7. Clause 3 provides other definitions including as to what constitutes "personal data" (clause 3(2)) and "processing" (clause 3(4)).

8. Paragraph 4 of Schedule 2 (which is to be found in Part 1 of that Schedule) consists of four subparagraphs.

9. The first of these provides that "the GDPR provisions" listed in the second subparagraph do not apply when personal data is processed to the extent that those provisions would be likely to prejudice the purpose of either "the maintenance of effective immigration control" or "the investigation or detection of activities that would undermine the maintenance of effective immigration control."

10. The GDPR provisions listed in the second subparagraph, to which this immigration exemption would apply, are each fundamental safeguards intended to protect the person to whom the data relates. Exempted safeguards include:

· That processing someone’s personal information is lawful, fair and transparent (Article 5(1)(a), GDPR);

· That this data is processed accurately and kept up to date (Article 5(1)(d), GDPR);

· That this data is held securely (Article 5(1)(f), GDPR);

· That the person to whom this data relates is informed of the data being held (Article 14, GDPR), for how long it may be held (Articles 13(2)(a) & 14(2)(a), GDPR) and for what purpose it may be used (Article 13(1)(c) & 14(1)(c), GDPR); and

· That this person may inspect the data (Article 15) and request its erasure or correction (Articles 13(2)(b) & 14(2)(c), GDPR).

11. The third subparagraph would exempt all persons handling the relevant personal data to an equal extent in relation to those GDPR provisions listed in the fourth subparagraph. It would do so in circumstances where one person (or e.g. Government department) obtains the data from another (e.g. another Government department or private body) for either of the two purposes specified in the first subparagraph. Thus where the Home Office obtained personal data from the NHS, the exemption would apply to both the Home Office and the NHS. Whereas the list in the fourth subparagraph is less extensive than that in the second, it nonetheless includes each of the provisions we specifically reference in paragraph 10 of this submission.

Ministerial assurances and justifications:

12. Concerns about the immigration exemption were raised at Commons’ Second Reading. Ministers effectively offered three justifications and assurances. Firstly, the Secretary of State for Digital, Culture, Media and Sport offered the assurance that "everyone who is a British citizen will have the right to make sure that data about them is held fairly and accurately, and in alignment with rigorous principles" (Hansard HC, 5 March 2018 : Column 76). Secondly, he emphasised that the exemption was necessary (Hansard HC, 5 March 2018 : Column 76). Thirdly, the Minister of State, Department for Digital, Culture, Media and Sport stated that the exemption would not have blanket application but would be applied only when necessary on an individual basis and with a right of appeal (Hansard HC, 5 March 2018 : Columns 130-131).

13. These assurances appear to arise from misunderstandings as to either or both of the text of the bill or the functions and practice of the Home Office immigration authorities.

British citizens

14. The Bill provides British citizens no protection from the exemption. If the Home Office determines it to be ‘necessary’ to apply the exemption to a person’s data, the Bill offers no protection on the grounds of citizenship status, British or otherwise. Thus, if the Home Office considers the personal data of a British citizen to be useful for exercising immigration functions or powers (e.g. tracing, detaining, removing her, his or their non-British partner), nothing in the Bill provides any additional or especial protection to the British citizen. British citizens would also be at risk in circumstances where the Home Office wrongly treats them as not British. Ministerial assurances may be based on the assumption that such mistakes will not happen. Yet such mistakes do happen. [1] Moreover, the error in the assumption is compounded because the exemption includes relieving the Home Office from requirements to ensure its data is accurate and to enable people to know the data held on them so that they may correct it. Accordingly, the exemption provides the very grounds for enlarging the risk of error and making the assumption, consequently, even less reliable.

15. In addition to people wrongly treated by the Home Office as not British, there are many other people who are entitled to British citizenship but are wrongly prevented from claiming that entitlement. This includes thousands of children and young people with a right to register as British citizens under the British Nationality Act 1981. [2] Among the many impediments to their doing so is the failure by the Home Office to consult, disclose or act on data available to it that may be relevant to establishing their right – such as where the British citizenship or settled status of the child or young person’s father or mother is known to the Home Office but where the child or young person does not have the documentary evidence to independently establish this. [3] Other impediments include a registration fee of nearly £1,000 demanded by the Home Office for the child or young person to have formally recorded (registered) the British citizenship that is their statutory entitlement; [4] and outstanding declarations, on which the Home Office are still yet to act, of the Supreme Court [5] and High Court [6] of incompatibility concerning the statutory application of a ‘good character’ test in relation to the rights to register of people wrongly excluded from British citizenship because of historical discrimination against children born out of wedlock or born overseas to British women.


16. At Commons’ Second Reading, Ministers gave no examples of when applying the exemption would be needed. Two examples were suggested at Lords’ Committee by the Minister of State, Home Office (Hansard HL, 13 November 2017 : Column 1914). The first was where the Home Office was seeking to trace a person who had overstayed her, his or their leave to enter or remain. The second was where the Home Office was making checks to verify the information given to it by a claimant.

17. Neither example demonstrates the need for the exemption, which can be readily appreciated by, firstly, reflecting on the protections to be exempted. For example:

· How would it serve any need to trace someone or to check information about them to exempt personal data held on them from general duties of accuracy and to process that data lawfully, fairly and securely?

· How would any tracing or checking be compromised by having informed someone, at the time she, he or they provided personal data (e.g. when she, he or they applied for leave to enter or remain), that the data will be held, for how long it may be held and that it may be checked or used to trace her, him or them if she, he or they were to overstay?

18. Secondly, it is yet to be asserted in the debates, though perhaps it will, that data protection has in the past disabled the Home Office from exercising its immigration functions. If that assertion were to be made, it would beg the question as to why it has not been made long before. In March 2013, when the Prime Minister, then Home Secretary, provided parliament with her concise analysis of what was wrong at the Home Office, lack of transparency and a secret, defensive culture were prominent criticisms of the department. [7] Data protections were not, however, suggested as hindering the department’s functions and responsibilities.

19. That someone knows or can check what of her, his or their personal data is held, and for what purposes it may be used, does not in itself reveal whether, what or when any immigration function or power is being exercised in respect of the person. It does not, in particular, impede any immigration function to inform someone that her, his or their personal data may be used by the Home Office for such things as verifying any claim she, he or they may make or tracing that person if she, he or they overstay. It is no secret that the Home Office does these things. Nor is it, or should it be, a secret that various information gateways now exist, which the Home Office uses for these purposes. While the existence of gateways and their operation is a matter of significant controversy and concern, [8] as the Minister was very careful to point out in the other place, this Bill does not create gateways (Hansard HL, 13 November 2017 : Column 1914). Rather it – or it should – establish safeguards in relation to personal data, including that data passing through such gateways.

20. That someone knows or can check what data is held and the purposes for which it may be used, however, does enable her, him or them to correct inaccurate data that may be held, and which if left uncorrected may result in serious harm to the individual and her, his or their family. The immigration exemption will not facilitate the carrying out of immigration functions by the Home Office (or other public or private bodies to whom such functions may be delegated). The exemption will, however, protect the Home Office (and others processing data for the Home Office) against being held to account for wrong, unjust and unlawful acts or omissions and consequent harms to people. As such the exemption is detrimental to its own stated purposes for, by increasing the risk and occasion of improper exercise of immigration powers it will specifically not further any true immigration purpose in the individual case and will further undermine confidence in the immigration system more generally.

No blanket application – only on case by case basis and with right of appeal

21. It is unclear to what right of appeal the Minster intended to refer in her closing remarks at Commons’ Second Reading. On the face of the matter, however, somebody, who is unaware personal data is held or unaware she, he or they are subjected to an act or omission because of that data, is in no position to bring any kind of action to remedy any inaccuracy, unlawfulness or other injustice in the data held or its use. Whether such a person would be able to effectively make use of any remedy in the unusual situation that she, he or they were alerted to the exemption having been applied is another matter. Legal aid is not generally available in non-asylum immigration cases, [9] and many people subjected to the exemption may be both unable to afford legal assistance and ill-equipped to initiate and pursue any remedy by themselves.

22. While the Minister said that use of the exemption would only be applied on a case-by-case basis, this offers little if any reassurance. She did not provide any example of when or how it would be decided to apply the exemption. While, the Minister in the other place suggested two examples, these were on their face very wide-ranging. Were these examples intended to indicate the exemption would be applied to all tracing of people suspected of overstaying and all checking of applications for leave to enter or remain? If not, nothing has been explained as to when and on what basis an official would determine to apply the exemption in any particular case but not in others. Moreover, these were given as examples. The implication must be that there are other Home Office functions and related activity, of a similar breadth in their scope, to which the exemption would be applied.

23. In the circumstances, it is difficult to understand how the exemption would not in effect be blanket in its application; but assuming it would not it is then difficult to understand how it would be applied in a way that was neither arbitrary nor merely intended to protect the Home Office against being held to account for poor or worse conduct. The Bar Council have warned that: [10]

"Allowing the Home Office an exemption from [Subject Access Requests] in immigration matters will have the effect of insulating the government from challenges to unlawful decision-making and of preventing individuals from correcting mistakes and overturning unlawful decisions that can have life-changing consequences."

24. We agree; and would add that the exemption applies to much more than removing the right to inspect data (Article 15, GDPR) by way of subject access requests. Generally, by facilitating or encouraging an environment in which the Home Office is made even less accountable for error or injustice, the exemption is likely to increase the likelihood, incidence and consequential harm of error and injustice.

The Home Office

25. The likelihood and extent of harm that the immigration exemption would cause can be judged by two further matters. Firstly, the range and nature of decisions and actions that would be taken on the strength of the personal data to which it relates. Secondly, the competence, capacity and reliability of the Government department that is primarily responsible for those decisions and actions, for controlling the relevant data and for applying the exemption – i.e. the Home Office. The first of these two matters is addressed below under a separate subheading.

26. Less than five years ago, when Home Secretary, the Prime Minister set out several, profound concerns about a chaotic immigration system and the department responsible for it. She particularly highlighted a "lack of transparency and accountability", "a closed, secretive and defensive culture", having "IT systems [that] are often incompatible and not reliable enough" and operating within "a vicious cycle of complex law and poor enforcement of its own policies" (Hansard HC, 26 March 2013 : Columns 1500-1501). Yet, immigration legislation, rules and policies have become more complex since that time; [11] and more safeguards – including legal aid and appeal rights [12] – have been removed or reduced.

27. In February, the Home Affairs Committee published its assessment of the Home Office preparedness to deal with the immigration consequences of Brexit. [13] The Committee identified the task facing the department: [14]

"Registration and administration arrangements need to change, new IT systems need to be developed, enforcement mechanisms need to adapt, and customs and border arrangements may have to change too. More than three million EU citizens living in the UK, and a further 230,000 EU citizens a year if current levels of immigration persist, may become subject to immigration control."

28. The Committee also found that "these directorates are already overstretched and face significant challenges in delivering new policies." [15]

29. Problems of incompetence, chaos and secrecy have beset the Home Office for many years. More than a decade ago, when Home Secretary, the Rt Hon the Lord Reid of Cardowan, was famously reported as designating the department ‘not fit for purpose’. [16] Parliament has nonetheless repeatedly sanctioned greater powers for the department while curtailing safeguards for people subjected to those powers. It may be this has been done on the basis of a similar assumption to that discussed earlier in this submission – i.e. that the exercise of Home Office powers will only ever be a concern for those persons lawfully and appropriately subjected to them. If so, the assumption is terribly misplaced. Those subjected to Home Office powers, and (as outlined below) wider immigration-related powers and impediments, include people and their family members who are British citizens or are entitled to that citizenship and people who are lawfully in the UK including settled here over many years and decades. They include many other people with permission to be in the UK or with good claims to that permission. Moreover, there is excessive, wrongful and harmful use of Home Office powers against people without permission to be in the UK, including, for example, by the use of powers to detain people on the basis of inaccurate and uncorrected information repeatedly relied upon by the Home Office when opposing bail applications. [17]

30. The Home Office has, in the name of effective immigration control, wrongly demanded people entitled to reside in this country leave it, [18] removed people entitled to be in this country from it [19] and denied citizenship of this country to people entitled to it; [20] and has, in pursuing the extensive powers that have been granted it over the years, continued to demonstrate the secretiveness and defensiveness that the Prime Minister correctly identified, [21] not to mention carelessness in handling of personal data. [22] Many examples have come to public attention over recent months, such as letters wrongly informing EU citizens that they had no right to be in the UK [23] and the acts of the Home Office in detaining and attempting to remove several Commonwealth citizens lawfully settled in the UK. [24] Some of the most egregious acts over the years have included effecting the forced and unlawful return of a refugee to the country in which he faced persecution by misapplying an unlawful policy purporting to permit the Home Office to deny him and his lawyers’ notice of his removal. [25] The enforced return of an asylum-seeker to the country where he feared persecution despite court orders precluding that. [26] The unlawful detention of a Dutch national over several months, purportedly for an enforced removal to Somalia, while retaining and ignoring his Dutch passport held on Home Office file. [27]

Wider immigration policy (‘the hostile environment’)

31. The harm that may be done to people – also their families, communities and employers – by wrongful Home Office decision-making and use of powers are extensive because of the nature of the decisions the Home Office makes and the powers it exercises. As regards those powers, they include powers to stop and search, [28] to detain (indefinitely, i.e. without limit of time, in nearly all cases) [29] and to remove, deport and exclude from the country. The decisions it makes concern whether a person’s citizenship or entitlement to be in the UK is recognised; decisions to grant, refuse or takeaway citizenship, permission to enter or remain in the UK; and decisions to impose conditions on a person’s presence in the UK (such as excluding permission to work, receive social assistance, study; [30] and imposing reporting and electronic tagging requirements).

32. However, the range of harms to which a person may be wrongfully subjected as a consequence of inaccurate or misused personal data go far beyond the immediate powers of and exercised by the Home Office. In recent years, immigration policy – particularly via the Immigration Acts 2014 and 2016 – has greatly extended the range of harms that may be done to people and the organisations and bodies that may do them harm. This has been done as part of what the Prime Minister originally styled a ‘hostile environment’. [31] An array of decisions are now required or enabled by employers, landlords, healthcare providers, education providers, local authorities, banks and others regarding whether someone may access various rights, services and opportunities. [32] These decisions are taken on the basis of citizenship or immigration status, often via systems of checks with the Home Office. Misuse of data by the Home Office, therefore, may threaten a person’s health, livelihood and home in a plethora of ways. The extension of these powers, even without exemption from data protection safeguards, is already causing significant harm – e.g. in deterring people from accessing healthcare services [33] and in encouraging people to wrongly, including on racial grounds, refuse tenancies. [34] The exemption threatens to exacerbate this.

Race discrimination and race relations

33. In 1983, the then Government withdrew a similar immigration exemption in response to concerns then raised as to the disproportionate impact the exemption would be likely to have on black people and other ethnic minorities. [35] It is remarkable that more than three decades later, the present Government – which only months ago published the Lammy Review [36] and its own Race Disparity Audit [37] (albeit neither the review nor the audit considered the impact of immigration policies and practice) – is attempting to bring back such an exemption. That is particularly remarkable, and concerning, given that the most significant difference between 1983 and 2018 is that in the intervening period, and especially over recent years, there has been a very great expansion in how the inaccurate or wrongful use of data for immigration-related purposes can cause real harm to people. This is in the nature of the hostile environment, which has made many more rights, services and opportunities dependent on an assessment of someone’s citizenship or immigration status; and in turn has increased the range of public and private organisations and persons making and acting on such assessments. Disproportionate and damaging impact on grounds of race is indicated by the increased reporting of how the lives of several black Commonwealth citizens lawfully settled in the UK have been blighted by the Home Office, and by decisions of others on the strength of the Home Office wrongly treating them as not entitled to be in the UK; [38] and by the sharp increase in detention of European citizens, of East European origin, over recent years.

Post script

34. We have sought to emphasise the extent of the human rights implications of the immigration exemption in this Bill, in part, by highlighting that among those affected would be e.g. British citizens, other people born in the UK (and not British but entitled to that citizenship) and long and/or permanent residents in the UK. However, our concerns regarding the harms the immigration exemption may cause extend to all persons who would be affected by the exemption, whatever their status, length of residence or entry into the country.

March 2018

[1] See, for example, the case of Shane Ridge:

[2] See, for example, the submission of the Project for the Registration of Children as British Citizens (PRCBC) to the Joint Committee on Human Rights’ 2016-17 inquiry into the UK’s record on children’s rights:

[3] This is one of the matters raised in the PRCBC submission (paragraph 10) op cit

[4] In one case last year, the Home Office was actively seeking to remove a 10 years old child from the UK, while knowing that she was entitled to British citizenship albeit unable to afford the fee to claim that entitlement. More information about this fee is available at:

[5] R (Johnson) v Secretary of State for the Home Department [2016] UKSC 56, judgment available at:

[6] R (Bangs) v Secretary of State for the Home Department (CO/1793/2017)

[7] Hansard HC, 26 March 2013 : Columns 1500-1501; and see paragraph 26 of this submission.

[8] The Health and Social Care Committee has, for example, called for the suspension of one such gateway between NHS Digital and the Home Office having received written and oral evidence from statutory bodies and civil society about the harms this gateway is causing, including one example of the death of a woman deterred from accessing healthcare altogether for fear of this gateway. More information regarding the inquiry, including evidence received, is available at:

[9] Non-asylum immigration cases were generally removed from scope on 1 April 2013 with the commencement of provisions of the Legal Aid, Sentencing and Punishment of Offenders Act 2012.

[10] See the briefing at:

[11] Criticism of the complexity of immigration rules has, for example, become a feature of judgments of higher courts including in one instance the Supreme Court commenting on how the Home Office view of the meaning of its own rules had changed during the course of the litigation of the matter before the court: see R (Mirza & Ors) v Secretary of State for the Home Department [2016] UKSC 63

[12] The Legal Aid, Sentencing and Punishment of Offenders Act 2012 removed legal aid for much immigration work; and the Immigration Act 2014 removed appeal rights for many people subjected to immigration decisions.

[13] Amnesty International UK’s submission to that inquiry is available at:

[14] Home Office delivery of Brexit: immigration, Third Report of Session 2017-19, HC 421, 14 February 2018, paragraph 3

[15] Ibid, paragraph 8

[16] See e.g.

[17] A matter raised, for example, in the report of Bail for Immigration Detainees, Liberty Deficit, November 2012:

[18] e.g. as reported by The Financial Times:

[19] As e.g. was the case with Mr Nyombi (see footnote 25, above); and as it sought to do in the case of Paulette Wilson:

[20] Such as in the case of Cynsha Best, referred to by The Independent: - but also note the experience of the Project for the Registration of Children as British Citizens (PRCBC), see

[21] The Home Office has been found to have unlawfully operated unpublished policies relating to detention and curfew restrictions: Abdi & Ors v Secretary of State for the Home Department [2008] EWHC 3166 (Admin); and Luppe v Secretary of State for the Home Department [2017] EWHC 2690 (Admin).

[22] This has been a cross-Government concern over many years, most recently highlighted by the National Audit Office:; and this is something on which the Joint Committee on Human Rights has previously reported: Data Protection and Human Rights, Fourteenth Report of Session 2007-08, HL Paper 72, HC 132

[23] Others have received such letters too, e.g.

[24] Various reports of, in particular, The Guardian and Channel 4 News have highlighted this, and its devastating impact over months and years, in relation to Paulette Wilson, Anthony Bryan, Hubert Leslie and Albert Thompson.

[25] R (N) v Secretary of State for the Home Department [2009] EWHC 873 (Admin); available at:

[26] The case of Samim Bigzad was widely reported including by the BBC, The Independent and The Guardian.

[27] Muuse v Secretary of State for the Home Department [2009] EWHC 1886 (Admin); [2010] EWCA Civ 453

[28] There are extensive police-like powers set out in Part III of the Immigration Act 1971 (as amended).

[29] See e.g. Amnesty International UJK’s report, A Matter of Routine, December 2017, available at:

[30] See, for example, section 3 and paragraph 21 of Schedule 2 to the Immigration Act 1971 (as amended).

[31] The term appears to have been coined by Theresa May in an interview with The Telegraph in May 2012.

[32] Part III of the Immigration Act 2014, for example, introduced new restrictions on accessing rented accommodation, healthcare, banking and driving licences, certain of which, particularly in relation to housing and accommodation, were enlarged upon by the Immigration Act 2016.

[33] See inquiry of the Health and Social Care Committee op cit, and Amnesty International UK’s submission at:

[34] Parliamentarians, the Residential Landlords Association and the Joint Council for the Welfare of Immigrants have been among those raising concerns about the discriminatory impact of measures introduced by the Immigration Act 2014 and significantly expanded upon by the Immigration Act 2016.

[35] That immigration exemption was to be found in clause 28 of the Data Protection Bill 1983.

[36] The Lammy Review focused on the criminal justice system, though it should be noted that discrimination and injustice in the criminal justice system may extend into the immigration system given the relationship between the exercise of removal and deportation powers. The report is available at:

[37] See

[38] See e.g. fn 24


Prepared 13th March 2018