Draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022
(2 years, 11 months ago)
General CommitteesRead Hansard Text Read Debate Ministerial Extracts
The Parliamentary Under-Secretary of State for the Home Department (Kevin Foster)
I beg to move,
That the Committee has considered the draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022.
As always, it is a pleasure to serve under your chairmanship, Ms Elliott.
Paragraph 4 of schedule 2 to the Data Protection Act 2018 outlines specific rights under the UK general data protection regulation, or UKGDPR, that can be restricted if they would likely prejudice either the maintenance of effective immigration control or the investigation or detection of activities that would undermine the maintenance of effective immigration control. That is known in shorthand as the immigration exemption.
The regulations amend the immigration exemption following the judgment handed down in the case of the Open Rights Group (and another) and the Secretary of State for the Home Department. In this case, the Court of Appeal held while there was nothing in principle unlawful about having an exemption for the purposes of maintaining effective immigration control, the legislation itself did not fully reflect the safeguards required by article 23.2 of the UKGDPR. As a result, the Home Office made a commitment to amend the immigration exemption, setting out additional safeguards, where further safeguards were considered relevant. The deadline for bringing those changes into force is 31 January 2022.
As part of the process of preparing the draft regulations, the Department has consulted with the parties to the litigation and with the Information Commissioner’s Office and has considered carefully their observations and comments, making amendments to the draft as appropriate. It may be helpful if I provide some brief details about the new safeguards.
The right of the data subject to be informed of the immigration exemption’s use, save in certain circumstances, is now on the face of the legislation, once again proving our commitment to be as open and transparent as we are able. We have also put in place an immigration exemption policy document explaining how the immigration exemption must be operationally applied and the circumstances in which data rights might be exempted. The IEPD has been published and we will, of course, keep it under review.
Publication will also give stakeholders the opportunity to offer their views on the IEPD, and where it can be improved, we will act to make it so. We are committed to addressing legitimate concerns, promoting high standards in the application of the immigration exemption, and protecting individuals’ personal data. We believe the IEPD builds on the rights and safeguards already enshrined in legislation and adds to the existing guidance the Home Office has published, and the Information Commissioner’s Office has published. As we said in court, we follow the ICO guidance and welcome the comments it will likely wish to make, and have already made, on the document.
To be clear, we are also specifically limiting use of the immigration exemption to the Secretary of State. We wanted to put beyond doubt that the immigration exemption may not be used by so-called ‘rogue landlords’ to restrict a person’s rights, a point specifically raised in court and by other parties.
I want to be clear that by laying the regulations, we are not seeking to remove anyone’s rights but to add more safeguards to them, and to increase transparency about how the immigration exemption will be used. That builds on the guidance that the ICO has issued, to which we are adhering, and will continue to do so.
I hope that I have given the Committee a good sense of why the regulations will make a positive difference to our law, and I commend them to it.
Naz Shah (Bradford West) (Lab)
It is a pleasure to serve under your chairmanship, Ms Elliott.
I heard the Minister set out the Government’s position and his suggestion that they are committed to fair processes. The Minister must recognise, however, the gravity of the proposed amendment. The Government have been dragged here to make that amendment because they lost a ruling at the Court of Appeal. Given the background of the Windrush generation case—the judge actually commented on that—does the Minister recognise the gravity of a situation in which campaigners have to go to court, subsequently win against the Government and the Government then have to introduce the regulations before us? The Government’s strategy was ill-judged in the first instance. I would be interested to understand the Minister’s thoughts on the campaigners’ view that the judgment and the proposed amending regulations do not go far enough to address the concerns of those who won the case.
In the second quarter of 2017, the success rate against the Home Office on immigration cases was 47%. That figure was part of the successful argument presented to the court by the campaigners. It has also been found that 10% of cases where a search of the Home Office database identified an individual as a disqualified person who should be refused a bank account were wrong. The Home Office has made terrible mistakes, and it should not require public campaigners to go to court to bring the Government into line.
The Opposition support the proposed regulations, but I would be interested to hear what the Minister has to say about my observations.
Mhairi Black (Paisley and Renfrewshire South) (SNP)
As everyone knows, we are here because the Court of Appeal found that schedule 2 was inadequate and does not provide enough safeguards. I welcome the fact that the Government have not sought to appeal that decision in the hope that they can remedy the situation via legislation, but the proposed regulations do not address the unlawful conduct identified by the court. GDPR recital (41) makes clear
“a legislative measure should be clear and precise, and its applications must be foreseeable to persons subject to it”.
The draft statutory instrument does not meet that requirement. The basic problem is that the Court of Appeal decided that article 23(2) of UKGDPR required additional safeguards. The SI does not provide that, and it does nothing to provide any clarity about or expansion of the existing safeguards.
Lord Justice Warby expressed his provisional view that such safeguards should be “part and parcel” of the legislation, but instead the draft SI refers to guidance that is removed from the legislation. First, the SI cannot be considered “part and parcel”, and secondly, such guidance has no force in law and can be changed with ease and without scrutiny. Thirdly, the guidance has not been approved by Parliament. It does not have the status of a code of practice that is approved by Parliament. I raise those pertinent points because my hon. Friend the Member for Cumbernauld, Kilsyth and Kirkintilloch East (Stuart C. McDonald) raised those very issues with exemptions back in 2018. If we fast forward four years, here we are with the same problem.
Given the court case arose after it was revealed that the UK Government were using the exemption to deny 60% of applicants access to their data, is it any surprise that the legislation is still wholly inadequate? The very wording is inadequate because the exemption policy document can be changed by the Secretary of State if they consider it appropriate. With the added backdrop of the broken nature of the Government’s hostile immigration system, and the need for overall reform in multiple areas, and although I welcome the fact that the Government are at least trying to do something, ultimately the draft SI does not solve the problems identified. If anything, it actually gives the appearance that its purpose is to serve and protect the Home Office and to give the Secretary of State the power to do as they see fit. With that in mind, I have to say that the SNP will oppose the regulations.
Kevin Foster
I appreciate the points raised by hon. Members. As has been said, we have not appealed the Court of Appeal’s judgment. In response to the SNP spokesperson, we felt it better to engage with the issues and seek to resolve some of the concerns. I understand the point about why not address all of the concerns in primary legislation but we felt that given concerns to do with data-processing, primary legislation raises certain issues, whereas published guidance is available, and in fact we have already published in draft and we have received comments. We expect that to be an evolving document. Of course, there would be an issue had we decided to issue private guidance, and questions would be asked about whether we were trying to avoid scrutiny.
We expect the published guidance to balance the need to give individuals access to information where appropriate and, for the sake of argument, not requiring the need to inform someone that we are taking immigration enforcement action or the details on what intelligence we may or may not have on activities, particularly on those who may be involved in potential criminal activity. Although we recognise that there is a crime exemption, we believe that there are circumstances where we need a specific immigration exemption as well, rather than try to extend the criminal exemption to cover immigration. Hence the action we have taken.
We believe that the regulations meet the objectives that were set out in the judgment. We appreciate that there will always be those who take a different view, and there will always be opportunity for oversight from the ICO and judicial oversight. We cannot change the regulations at will if that then undermined the purpose of the core legislation. We believe the regulations represent a positive step forward that will resolve the core concerns. In particular, it is made very clear that their use is restricted to the Secretary of State, given that the purpose is to maintain effective immigration control, not to give an excuse to third parties to try to withhold data that should be released. That core point has been raised by many, but we should be clear that the exercise of the power lies with the Home Secretary in terms of defence of the immigration system, and not with a landlord or agent who may seek to argue the exemption when required to declare information.
We believe that the regulations are the appropriate step forward. We recognise that we are responding to a court judgment, but we did not seek to appeal the matter to the Supreme Court because we thought that the points made in the judgment were reasonable and ones that we could accept. I repeat that the document will be an evolving one.
Michael Fabricant
A very brief one, indeed. Is my hon. Friend confident then that there will not be another appeal? My hon. Friend would then be back here again coming up with another amendment. Does the SI actually meet the requirements of the court and the judgment?
Kevin Foster
We believe that it does. I can never guarantee that someone will not take legal action against the Home Office. The campaigners won and it would have been the Home Office that would look to appeal to the Supreme Court. As the hon. Member for Paisley and Renfrewshire South noted, we decided not to appeal but to engage with the judgment and introduce additional safeguards instead. The principle of having this type of legislative exemption was deemed to be perfectly rational, but it was felt that there was a need to be clearer and to have certain published safeguards on its use.
Given some of the data-sharing arrangements with the European Union on adequacy arrangements and the carve up it applied, we have engaged with the European Commission, and we are confident about our policy. Can I guarantee that no one will launch a legal challenge against the Home Office in future? No. We live in a country where people are able to do that. I have set out the purpose of the regulations, however, and the need for them. As I said, this is not about taking away anyone’s rights or weakening any protections on data access, rather the regulations are designed to strengthen those protections and to produce a living document that can respond to emerging issues and trends, and can be amended where appropriate.
Question put and agreed to.