Data Protection Bill

Written evidence submitted by Open Rights Group and the3million (DPB25)

Open Rights Group is a digital rights campaigning organisation. Campaigning for a world where we each control the data our digital lives create, deciding who can use it and how, and where the public’s rights are acknowledged and upheld.

the3million is the largest grassroots organisation of EU citizens in the UK, and campaigns for all EU citizens living here to be able to continue life as usual after Brexit.

Evidence submission by Open Rights Group and the3million for the Public Bill Committee of the Data Protection Bill’s immigration exemption (Schedule 2 , Paragraph 4).


1. The Government has introduced the Data Protection Bill with a new exemption to data protection. The exemption for immigration (Schedule 2, Paragraph 4) would remove the fundamental right for individuals to access their personal data when it would prejudice "effective immigration controls" or "the investigation or detention of activities that would undermine the maintenance of effective immigration control."

2. In practice, this would mean that:

· Foreign residents, including 3 million EU citizens, would lose the right to access and be informed about what data is being used about them in immigration cases;

· Foreign residents, including 3 million EU citizens, would lose insight into decisions and errors made by immigration authorities;

· The Home Office could share immigration - related data without restraint or safeguards outside of the EU ;

· The Home Office, other government bodies and private sub-contractors would no longer be bound to the general principles of data protection, including "lawfulness, fairness, and transparency" and "integrity and confidentiality".

3. The Government has claimed that they limited the scope of this exemption while the Bill was in the House of Lords. The immigration exemption does not apply to the right to portability and the right to rectification; while the earlier version of the Bill removed all the rights given to data subjects in the General Data Protection Regulation. However, these changes are cosmetic and will not reduce the negative impact of the measures, as portability generally does not apply to public authorities, and rectification requires previous access to the data.

4. The Open Rights Group and the3million have outstanding concerns regarding the current standing of the immigration exemption (Schedule 2 Paragraph 4). Our concerns are echoed by other organisations, including Liberty, UNISON and Immigration Law Practitioners Association.

5. On the grounds of these concerns, we urge you to remove the immigration exemption from the Data Protection Bill.

6. Our concerns:   

· The scope of the exemption would disproportionately interfere with the fundamental rights of privacy, data protection, due process, equality and non-discrimination of m illions of UK foreign residents .

· The exemption treats all migrants going through immigration processes as potential criminals - it aims to ensure that ‘investigations’ are not ‘endangered’ through releasing data to wrongdoers. The reality is that most immigration procedures are administrative matters, precisely where data protection is expected to keep checks on the power of public authorities.

· The blanket exemption seems to conflict with the provisions in the EU’s General Data Protection Regulation (GDPR) for restriction of rights and fundamental principles. Such conflict will weaken the prospect that the UK will get a green light from the European Commission for personal data transfers after Brexit.

· The exemption is likely to become a matter of dispute between the UK and EU in the forthcoming negotiations since it will effectively go against the promises made by the Prime Minister about EU residents’ rights.

Rights of EU citizens                    

7. The immigration exemption will mean that EU citizens will have less access to their personal data than UK citizens after the UK leaves the EU. The exemption effectively covers all foreigners and their families, which is too broad and appears to undermine the essence of fundamental EU rights [1] , including:

· Article 8 granting protection of personal data, but also

· Article 20 providing for equality before the law, and

· Article 21 on non-discrimination.

8. The proposed restrictions of subject rights would mean that people who are subject to immigration procedures would not have a right to know that their data is being pro cessed by another authority. This issue was recently illustrated by the Memorandum of Understanding between the Home Office and NHS Digital [2] which saw NHS providing information such as address, date of birth and GP details to immigration officials.

9. Individuals involved in migration disputes would not have the right to obtain their personal information from the Home Office. This is the most basic requirement to be able to handle an administrative dispute. Immigration lawyers routinely use Subject Access Requests to obtain information about clients from the Home Office, and the immigration exemption will make it harder for them to represent their clients effectively – for example, where applications are refused due to an error [3] , or if a client is making an appeal against a Home Office decision. This is demonstrated in more detail in several case studies included in the Annex of this document.

10. The Bill is being introduced just as EU citizens now living in the UK face a new process proposed by the UK government, requiring them to apply for "settled status" after Brexit day with the possibility of having their application rejected . After Brexit, EU citizens may need access to their data as part of contesting Home Office decisions on residence and making other claims. The government has itself committed to having a "transparent, streamlined" application system for EU citizens to prove their long- term residence after Brexit, and we are concerned that transparency will be undermined by this exemption.

Criminalisation of migrants

11. The exemption is modelled on existing exemptions for criminal cases. However, people making immigration claims are not criminals, nor are they attempting anything unlawful - they are merely trying to claim their right to remain in the UK. Three million EU citizens may need to assert these rights, and should not be treated as if they are criminals.

12. The Bill already contains appropriate exemptions for law enforcement to cover offences such as working illegally, providing false information, or trafficking.

Lack of compatibility with the EU law                

13. These proposals are so broad that they likely breach the narrow criteria that the GDPR sets out for such provisions. The restrictions to data protection rights are based on Article 23 [4] of the GDPR which sets out the requirement that

14. "such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society."

15. The proposed blanket exemption would remove the obligation on the Government to process personal information fairly and transparently and for purposes compatible with those for which the data was obtained in the first place.

16. Blanket removals of such fundamental data protection principles go against the basis of the GDPR despite the Government asserting the claims that the removal is in the public interest. Article 6(3) explains that derogations for public interest should have their own legal basis which includes "measures to ensure lawful and fair processing" of data [5] .

Brexit negotiations and future treaties

17. The immigration exemption would affect both data protection rights and the ability of EU citizens in the UK to claim their residency rights, therefore it is likely to become a matter of dispute between the UK and EU in the forthcoming Brexit negotiations. Note that the exemption will effectively go against the promises made in the Prime Minister’s Lancaster House speech about EU citizens’ rights: "the same rules and laws will apply on the day after Brexit as they did before" [6] .

18. The exemption is certain to face legal challenges. It could also endanger any treaty made between the UK and EU. The EU has a legal obligation to ensure that the fundamental rights of its citizens are protected in international agreements, so could not lawfully agree to allow these rights to be removed as a result of a UK-EU treaty.

Rights to portability and rectification do not fix the exemption        

19. The two concessions offered by the Government do not improve the immigration exemption in any way. The right to data portability is designed for consumers to exercise their free choice of services and does not generally cover administrative purposes. For example, the data portability right will give people a chance to change mobile and broadband providers more easily. As such, the Government’s concession allowing immigration subjects to maintain the right to data portability is redundant. Similarly, the right to rectification is likely to prove difficult for people to assert if they cannot access their data in the first place.

20. In summary, these broad exemptions should be removed from the face of the Bill.



Proposed draft amendment

Schedule 2, page 136, line 30, leave out paragraph 4

Explanatory statement:

This amendment would remove immigration from the exemptions from the GDPR.

Case Studies

The following case studies are anonymised real-life cases, demonstrating how vital data protection rights are in making correct decisions to facilitate effective and fair immigration control.

Case study A

20. Immigration law practitioners are regularly instructed by clients wishing to apply for indefinite leave to remain on the basis of being victims of domestic violence. Clients are required to prove that their relationships came to an end as a result of domestic violence. This can be impossible to achieve without access to data held by the Police, doctors and the Home Office in relation to incidents and reports of abuse.

Case study B

21. Law practitioners are often instructed by vulnerable clients who because of - for example - destitution, irregular living arrangements and ill mental health have little documentation and understanding of their case. Through Subject Access Request with the Home Office lawyers are able to gather vital information about client’s immigration history. It is a common issue that this information is not freely available from the Home Office and the best strategy is not identifiable until the full paperwork is acquired.

Case study C

22. Law practitioners were instructed by an EEA national in detention. She had been identified previously as a victim of trafficking but because the Home Office had made a decision to deport her some years ago they were seeking her removal. Because of her trafficking, irregular addresses and poor health she was unable to lodge an appeal against the decision. Her lawyers lodged a S ubject A ccess R equest with the Home Office to request a copy of the decision to deport her to establish if there were grounds to challenge it. The Home Office did not disclose the document. It was only through legal action against the Home Office that they were able to recover the decision. Lawyers identified that the decision was arguably flawed. They then lodged and were granted an out of time appeal to challenge the decision in the tribunal. The case is pending.

Case study D

23. A client of a law firm was detained for 17 months because the Home Office denied they were a British Citizen. When his lawyers applied for the client’s Home Office file, through a subject access request, they discovered the Home Office held evidence that the client was British.

Case study E

24. A law firm was instructed by an asylum seeker whose application had been refused. The basis of his claim was that he feared the authorities in his home country because they believed he was a spy. He had previously been tortured. The Home Office had stated (amongst other things) that his account could not be believed because he had not told anyone about his previous experience of torture. The client stated that he had told a doctor whilst previously in detention. Through a subject access request his lawyers were able to identify documents that demonstrated he had told a doctor of his experience. This supported his case and helped towards overturning the Home Office’s decision.

Case study F

25. A client of a law firm had their naturalisation application refused because they had all egedly worked when they should not have been working . The Home Office alleged that they had written to the client seeking information, and in response they had provided details of unlawful working. The client’s position was that this was not the case and that the Home Office were mistaken. A subject access request was submitted. The information provided in response established the Home Office had not written to the client. Moreover, and as a result, no information had been provided showing that the client had engaged in unlawful work. The decision to refuse was challenged and overturned.

Case study G

26. A client of a law firm , with schizophrenia, was facing removal under Dublin III [7] . The Home Office have strict timelines to comply with under this agreement. Through the response to a subject access request, it became clear that the Home Office could not remove the client because the deadline to do so had passed. Legal representatives of the client were also able to establish that the client had been identified as a victim of trafficking and was still pending a conclusive grounds decision from the Home Office. The client’s removal was cancelled, and they were able to remain in the UK.

March 2018


Prepared 13th March 2018