Draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024
The Minister for Legal Migration and the Border (Tom Pursglove)
I beg to move,
That the Committee has considered the draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.
It is a pleasure to serve under your chairmanship, Ms Vaz. This statutory instrument, which was laid before the House on 31 January, will amend paragraph 4 of schedule 2 to the Data Protection Act 2018, more commonly known as the immigration exemption. Members are likely to be aware that the Government are amending the provisions following the Court of Appeal judgment of 11 December 2023. The judgment was a result of judicial review and the court found the immigration exemption incompatible with provisions in the UK GDPR. The court suspended the effect of the judgment until 11 March 2024.
I will briefly outline what the immigration exemption does and the changes that the Government are making in response to the Court of Appeal’s judgment. Parliament included the immigration exemption in schedule 2 to the Data Protection Act. The exemption provides a legal basis to derogate from certain data subject rights where their exercise would be likely to prejudice effective immigration control. For example, the data subject has the right to request and receive details of what personal data is held about them and how it is being processed, commonly known as a subject access request.
Under the provisions of the immigration exemption the Government may limit the information provided in response to a request if the provision of that information would prejudice effective immigration control—for example, if it tipped off the data subject about a likely immigration visit. The immigration exemption is therefore an important provision in the DPA 2018, which allows the Government to protect the functioning of the immigration system. That was noted specifically by the Court of Appeal in its judgment.
The Court of Appeal noted two technical deficiencies in the current exemption in its judgment. First, the safeguards to be applied to the immigration exemption needed to be in the legislation itself. That is being amended by new paragraph 4A in the regulations, which inserts on to the face of the legislation the safeguards on the use of the immigration exemption previously contained in the immigration exemption policy document.
The Court also determined that the risks to rights and freedoms of individuals were not sufficiently set out in the legislation. That is being remedied by new paragraph 4A(3) in the regulations, which specifically sets out the rights and vulnerabilities that should be taken into account when exercising the exemption. By including those explicitly in the legislation we are providing increased clarity on the safeguards that are already applied when exercising the provisions of the exemption.
The Government are also choosing to explicitly include provisions on the balancing exercise that must be undertaken when determining whether the exercise of data rights is likely to prejudice effective immigration control and if it is necessary and proportionate to restrict such rights as a result. The draft regulations were subject to consultation with the parties to the judicial review proceedings as well as the Information Commissioner’s Office. The ICO issued a public response to the consultation confirming it was content with the regulations.
The Government have acted to meet the requirements of the Court of Appeal’s judgment while continuing to ensure there are necessary safeguards in the legislation to protect effective immigration control. I therefore commend the draft regulations to the Committee.
Alex Norris (Nottingham North) (Lab/Co-op)
It is a pleasure to serve with you in the Chair, Ms Vaz. This statutory instrument comes at the end of what might be described as a more than five-year saga over the compatibility, or lack thereof, of the immigration exemption, as set out in the Data Protection Act 2018, with the UK General Data Protection Regulation enacted during the Brexit transition. This particular SI, as the Minister has explained, was necessary following the Court of Appeal’s decision late last year, which required that greater specificity with regard to safeguards related to the immigration exemption be incorporated into legislation as opposed to guidance. As such, we of course support the SI and will not oppose its passage today.
The Minister’s predecessors created the problem when they created the exemption regarding subject access, which usually would be routinely available to individuals under British, and previously European, data protection laws. Such a significant change—and the Minister made an important case for why that divergence from usual practice is important for the operation of our immigration system—was of course going to need clearer definitions, so that members of the public requesting information and those who respond to such requests on behalf of the Government had clarity about when and where that exemption applied. The absence of such clarity, which the courts ruled had to be set out in statute, is what has brought us here today, but, as I say, we will support the statutory instrument.
The Home Office has contested this over the years, so will the Minister say what costs have been involved in taking through those long court cases? Similarly, and most crucially, paragraph 7.1 of the explanatory memorandum says the Home Office consulted the litigants, namely the Open Rights Group and the3million, as well as others, on the degree to which this SI meets the concerns that led to that legal action in the first place. The memorandum also notes that no changes happened as a result of the consultation.
The Minister has given us helpful clarity on the ICO’s views, but based on those conversations, is he certain that we have now seen the end of the legal proceedings, that this is the settled position of the Government, that the campaigners are broadly happy with it and that we will not be back in court? I know that the Minister, by nature and instincts, will not want to mess around and will want to get this resolved, so I guess I am asking whether he is certain that these regulations have resolved that issue.
Alison Thewliss (Glasgow Central) (SNP)
It is a pleasure to see you in the Chair, Ms Vaz. I pay credit to the3million and the Open Rights Group for having pursued this important issue through the case, exposing the misuse of this GDPR exemption to profile the data of all migrants. I am deeply concerned about this practice, which was deemed unlawful by the judge. I am concerned because I have had cases in the past where data was obtained and used by different arms of Government to build a case against a group—highly skilled migrants—who were then refused their leave to return under paragraph 322(5) of the immigration rules. In that case, there was an exchange of information between His Majesty’s Revenue and Customs and the Home Office, so it concerns me greatly that people’s travel patterns and the way in which they were moving around were being harvested by the Home Office without their consent.
That leads me to a number of questions. First, what is the Government’s response to the judgment, which said that
“the use of the Immigration Exemption by the Home Office has been extensive”?
How many people were affected by that? Do those people know and have they been notified that their data was being used in that way? How many people have seen a consequence of this piece of harvesting? Does the Minister have any examples of where people have been removed from the country or not had their citizenship or anything else extended as a result of some of that data harvesting? Were they aware that this was indeed why they had been excluded in their own cases?
The case also spoke to the need for safeguards and tests. The Minister talked about the3million and the Open Rights Group being consulted. Was there any response from them to the Government’s consultation. because I would have thought they would have had something to say about it? I am curious if that has not been the case because I would like their assurance that the safeguards and tests the Government were talking about will be effective in practice. In the execution of those safeguards and tests, what advice and training is being given to Home Office employees about their duties and obligations under this new legislation to change from the previous practice? That would ensure that the same people do not do the same things because that is how they have always been done. It would also reflect the fact that there has been a court case and that a change ought to be put in place.
The Court judgment also states:
“An obligation to merely ‘have regard to’ a code or policy will not do.”
It is good to see the legislation coming forward and it certainly shows a serious deficiency in the Home Office’s practice over many years.
In relation to the queries on subject access requests by the hon. Member for Nottingham North, does the Minister have any data or figures on how many subject access requests are made to his Department that would be covered under this legislation? Some people know about subject access requests and they employ them, but many others will not have known to do that in the first place. Does the Minister have that data? Also, is there any need for recourse to people who have been affected by the execution of the policy?
Finally, I have deep concerns about the practice and procedures of the Home Office. Given that the judge said that use of the exemption “has been extensive”, I am deeply concerned that it has been used as a fishing exercise in pursuit of the goals of creating a hostile environment and that the Home Office is treating people who have done us the honour of coming to live here differently from those who were born here. That is of deep concern to everybody who comes and makes their home here. They should not be subjected to activity that has been found to be unlawful; the Home Office tends to treat everybody with suspicion at all times. That has a damaging effect on those who choose to come and make their homes here. It is them I think of when I see these kinds of cases, because they deserve much better than the treatment they have received from this Government.
John McDonnell (Hayes and Harlington) (Lab)
I refer to paragraph 6.11 in the explanatory notes, which notes the insertion of new paragraph 4A(4). I am working on the basis that this is the Government acknowledging that, following the Court case, some form of compromise has to be reached with every party involved.
The issue that has concerned many of us in the past was balancing the risk between the operation of immigration controls and the individual’s rights. I welcome the Minister’s reassurance, and I speak on the basis that these regulations are the compromise. The new paragraph explains that the balance of risk relates to whether there is a substantial risk of prejudice either way. Therefore, the individual and the operation of the immigration control mechanism are both protected. Obviously, some of that will now be developed by case law decisions on the balance of risk, but it may well be challenged in future. First, did all parties to the court case sign up to the very specific wording of the compromise?
Secondly, we have had problems with this in the past, so how can we monitor its operation in future and how will that be reported through the system and into Parliament? This is not to be oppositional in any form, but learning lessons from the operation of such new procedures may mean that we want to adjust the process in future. It behoves Parliament to take a particular interest in monitoring the operation of this new compromise—and I hope that it is a compromise—that has been agreed.
Tom Pursglove
I thank colleagues from across the House for their various questions, which I will gladly respond to in winding up the debate. The first was from the hon. Member for Nottingham North about whether we consider this to be the end of the matter. He will appreciate that it is never possible to guard against any individual bringing forward a case if that is what they choose to do. However, I can say that we are confident that the exemption addresses the issues that the Court identified in its judgment in full. That view is also shared by the ICO, as I set out in my opening remarks, which has publicly stated that it is content with the regulations.
That links to the issue of consultation and engagement, and there are a number of questions around that. The claimants were consulted as part of the development of the provisions and they made some additional suggestions. Beyond that, the Court of Appeal gave a three-month period for the Government to amend the exemption, after which it would be unlawful. We are of course complying with that judgment, and that is reflected in the statutory instrument before us. A full public consultation was therefore impossible, but, as I said, consultation took place with the ICO, the claimants in the case, the Open Rights Group and the3million. Given the nature of the judgment and the changes required, the Government did not consider it necessary to consult more widely.
Alison Thewliss
The Minister says that the3million and the Open Rights Group were consulted and made suggestions. Did the Government make any changes as a result of those suggestions?
Tom Pursglove
It is fair to say that we as the Government have reflected on the conversations that we have had, and the regulations we are debating reflect those conversations. As I say, the ICO is clear about its stance in being in adherence with the outcome of the court case. That is important to acknowledge in relation to this.
On the specific question of costs, I cannot commit to giving a specific figure today. However, once all the costings around the case have been settled and the process has been settled and finalised in the usual way, I can most certainly provide a figure to the House.
There was a perfectly legitimate question about how data subjects know that the exemption has been used. The exemption includes a presumption that data subjects are to be informed where the exemption provisions have been applied in their case, unless informing the data subject of the application would in itself prejudice the purpose of the exemption. Linked to that was an inquiry about the use of the exemption. For the year ending October 2023, the immigration exemption was applied to about 70% of subject access requests received in relation to immigration, citizenship and Border Force. Of those, the vast majority had only a small amount of data redacted under the use of the exemption.
Rightly, there were also questions around safeguards. To be clear, the Court of Appeal judgment was specific in the areas that it deemed the immigration exemption to be incompatible with UK GDPR. This statutory instrument addresses comprehensively those issues, and the safeguards are set out clearly on the face of the legislation. The immigration exemption needs to be flexible in order to account for a range of scenarios, and going into more detail in the legislation risks compromising both the purpose of the exemption and the rights of data subjects, as I am sure the Committee will understand.
However, in recognition of that, routes of redress exist for data subjects, with the standard routes of redress being where a data subject feels that the immigration exemption has applied to them wrongly. Those data subjects may complain to the Home Office as the data controller, and they can also contact the ICO, which has appropriate powers to investigate instances of non-compliance with data protection law. In addition to contacting the ICO, data subjects can legally challenge an application of the immigration exemption in the courts.
John McDonnell
It would be useful if you answered the questions that were put to you.
The Chair