Draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Alison Thewliss Excerpts

Wednesday 28th February 2024 General Committees

[Alison Thewliss (Glasgow Central) (SNP)]

It is a pleasure to see you in the Chair, Ms Vaz. I pay credit to the3million and the Open Rights Group for having pursued this important issue through the case, exposing the misuse of this GDPR exemption to profile the data of all migrants. I am deeply concerned about this practice, which was deemed unlawful by the judge. I am concerned because I have had cases in the past where data was obtained and used by different arms of Government to build a case against a group—highly skilled migrants—who were then refused their leave to return under paragraph 322(5) of the immigration rules. In that case, there was an exchange of information between His Majesty’s Revenue and Customs and the Home Office, so it concerns me greatly that people’s travel patterns and the way in which they were moving around were being harvested by the Home Office without their consent.

That leads me to a number of questions. First, what is the Government’s response to the judgment, which said that

“the use of the Immigration Exemption by the Home Office has been extensive”?

How many people were affected by that? Do those people know and have they been notified that their data was being used in that way? How many people have seen a consequence of this piece of harvesting? Does the Minister have any examples of where people have been removed from the country or not had their citizenship or anything else extended as a result of some of that data harvesting? Were they aware that this was indeed why they had been excluded in their own cases?

The case also spoke to the need for safeguards and tests. The Minister talked about the3million and the Open Rights Group being consulted. Was there any response from them to the Government’s consultation. because I would have thought they would have had something to say about it? I am curious if that has not been the case because I would like their assurance that the safeguards and tests the Government were talking about will be effective in practice. In the execution of those safeguards and tests, what advice and training is being given to Home Office employees about their duties and obligations under this new legislation to change from the previous practice? That would ensure that the same people do not do the same things because that is how they have always been done. It would also reflect the fact that there has been a court case and that a change ought to be put in place.

The Court judgment also states:

“An obligation to merely ‘have regard to’ a code or policy will not do.”

It is good to see the legislation coming forward and it certainly shows a serious deficiency in the Home Office’s practice over many years.

In relation to the queries on subject access requests by the hon. Member for Nottingham North, does the Minister have any data or figures on how many subject access requests are made to his Department that would be covered under this legislation? Some people know about subject access requests and they employ them, but many others will not have known to do that in the first place. Does the Minister have that data? Also, is there any need for recourse to people who have been affected by the execution of the policy?

Finally, I have deep concerns about the practice and procedures of the Home Office. Given that the judge said that use of the exemption “has been extensive”, I am deeply concerned that it has been used as a fishing exercise in pursuit of the goals of creating a hostile environment and that the Home Office is treating people who have done us the honour of coming to live here differently from those who were born here. That is of deep concern to everybody who comes and makes their home here. They should not be subjected to activity that has been found to be unlawful; the Home Office tends to treat everybody with suspicion at all times. That has a damaging effect on those who choose to come and make their homes here. It is them I think of when I see these kinds of cases, because they deserve much better than the treatment they have received from this Government.

--- Later in debate ---

[Tom Pursglove]

I thank colleagues from across the House for their various questions, which I will gladly respond to in winding up the debate. The first was from the hon. Member for Nottingham North about whether we consider this to be the end of the matter. He will appreciate that it is never possible to guard against any individual bringing forward a case if that is what they choose to do. However, I can say that we are confident that the exemption addresses the issues that the Court identified in its judgment in full. That view is also shared by the ICO, as I set out in my opening remarks, which has publicly stated that it is content with the regulations.

That links to the issue of consultation and engagement, and there are a number of questions around that. The claimants were consulted as part of the development of the provisions and they made some additional suggestions. Beyond that, the Court of Appeal gave a three-month period for the Government to amend the exemption, after which it would be unlawful. We are of course complying with that judgment, and that is reflected in the statutory instrument before us. A full public consultation was therefore impossible, but, as I said, consultation took place with the ICO, the claimants in the case, the Open Rights Group and the3million. Given the nature of the judgment and the changes required, the Government did not consider it necessary to consult more widely.

[Alison Thewliss]

The Minister says that the3million and the Open Rights Group were consulted and made suggestions. Did the Government make any changes as a result of those suggestions?

[Tom Pursglove]

It is fair to say that we as the Government have reflected on the conversations that we have had, and the regulations we are debating reflect those conversations. As I say, the ICO is clear about its stance in being in adherence with the outcome of the court case. That is important to acknowledge in relation to this.

On the specific question of costs, I cannot commit to giving a specific figure today. However, once all the costings around the case have been settled and the process has been settled and finalised in the usual way, I can most certainly provide a figure to the House.

There was a perfectly legitimate question about how data subjects know that the exemption has been used. The exemption includes a presumption that data subjects are to be informed where the exemption provisions have been applied in their case, unless informing the data subject of the application would in itself prejudice the purpose of the exemption. Linked to that was an inquiry about the use of the exemption. For the year ending October 2023, the immigration exemption was applied to about 70% of subject access requests received in relation to immigration, citizenship and Border Force. Of those, the vast majority had only a small amount of data redacted under the use of the exemption.

Rightly, there were also questions around safeguards. To be clear, the Court of Appeal judgment was specific in the areas that it deemed the immigration exemption to be incompatible with UK GDPR. This statutory instrument addresses comprehensively those issues, and the safeguards are set out clearly on the face of the legislation. The immigration exemption needs to be flexible in order to account for a range of scenarios, and going into more detail in the legislation risks compromising both the purpose of the exemption and the rights of data subjects, as I am sure the Committee will understand.

However, in recognition of that, routes of redress exist for data subjects, with the standard routes of redress being where a data subject feels that the immigration exemption has applied to them wrongly. Those data subjects may complain to the Home Office as the data controller, and they can also contact the ICO, which has appropriate powers to investigate instances of non-compliance with data protection law. In addition to contacting the ICO, data subjects can legally challenge an application of the immigration exemption in the courts.