Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Debate between Baroness Hamwee and Lord Clement-Jones

Tuesday 5th March 2024 Grand Committee

[Baroness Hamwee (LD)]

My Lords, I thank the Minister for that explanation. I have to say that my recollection is that the issue is much wider than the exemption and ensuring that there is no tip-off to somebody who is about to be visited by immigration enforcement. Let me give an example that was borne out after the Act was passed: solicitors acting for data subjects were unable, as we had anticipated, to find out what the Home Office thought it knew—I put it that way deliberately —about their clients.

I have some general points to make; I will do so fairly quickly. It would be optimistic to think that the Home Office had taken from this saga that objections and criticisms—in the form of amendments, obviously—can be helpful because we could have avoided a lot of effort in rectification. My noble friend Lord Clement-Jones will go into some of the history; I must admit, I do not recall much detail except for being teased frequently by the noble Baroness, Lady Williams, when she was the Home Office Minister, because I brought up our objection to the immigration exemption so often.

I feel strongly that it should not have to be for non-governmental organisations that are no doubt strapped for cash to do so much in order to get things right. I appreciate that that is part of our democracy; I do not object at all to the fact that they can do so, of course, but they should not have to. An application, an appeal, another judicial review, another appeal—at what cost to those organisations and the taxpayer! I emphasise that there is an exclamation mark, not a question mark, at the end of that sentence.

This saga is one of those episodes that vindicates the role of the courts, often in language that I, for one, relish. We have spent a lot of time in the Chamber recently discussing the role of the courts in our constitution; to give one example of the language, I really liked the understated use of

“over-broad derogations from fundamental rights”.

As the Minister said, the litigants were consulted before the publication of the SI. The Secondary Legislation Scrutiny Committee reports that it made three points, of which one, on oversight, was rejected by the Home Office and one was regarded by the Home Office as not necessary. Can the Minister tell the Committee what these were and why they were not pursued?

On the detail of the instrument, I note that it will be a matter for the Secretary of State to balance the risks to the individual and the risks to the state. I happen to think that it is in the public interest to apply exemptions with a very light touch, but of course it is no secret that the Liberal Democrats have problems with the Home Office’s immigration policy, and I fear that the reputational ship is well on its way. Clearly, there is an imbalance of power. That is inevitable, but it is not easy for the individual data subject to exercise his rights, and we should be aware of that.

Can the Minister also tell us what the Home Office will do to ensure that there will be transparency of decisions so that it can appropriately be held to account? Mechanisms must be written into the procedures. New paragraph 4B of Schedule 2 provides for a record of decisions and reasons. How will that be published and what will happen to it?

Will the Minister also comment on the capacity of immigration enforcement—and whoever else needs to—to look at prospective decisions on a case-by-case basis for each disapplication? I recognise that that will not necessarily be a straightforward and easy exercise, but it certainly requires a great deal more than, “It’s okay; it’s immigration, so we can just rely on the exemption”. Case-by-case decision-making is very important.

Finally, I note that the Explanatory Memorandum tells us that there is no full impact assessment because the instrument

“does not substantively alter the safeguards and considerations for applying the Immigration Exemption”.

I have to say that I thought that was the point.

[Lord Clement-Jones (LD)]

My Lords, this set of regulations is a step forward, but with all the caveats that my noble friend made, and I have some more.

As the Minister confirmed, these regulations are the result of the Open Rights Group case—the Court of Appeal judgment in the3million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor—which confirms the earlier High Court judgment in March 2023. In broad terms, the Court of Appeal found that the immigration exemption in Schedule 2 to the Data Protection Act 2018 conflicted with the safeguards in Article 23 of the UK GDPR, as the Minister said. This was because the immigration exemption was drafted too broadly and failed to incorporate the safeguards prescribed for exemptions under Article 23 of the UK GDPR. It was therefore held to be unlawful and was disapplied.

These regulations follow two previous attempts by the Home Office to craft an immigration exemption which contained sufficient safeguards to satisfy the requirements set out in Article 23 of the UK GDPR. This is the third shot at it. In order to make the immigration exemption compatible with the requirements of Article 23, as the Minister explained, the Government added a number of safeguards to the exemption which were not there before. These are set out in the regulations. They are worth stating because they are really important requirements, which were omitted previously.

They include requirements to: make decisions on the application of the exemption on a case-by-case basis; make separate decisions in respect of each of the relevant UK GDPR provisions which relates to the data subject; make fresh decisions on each occasion where there is consideration or restriction of any of the relevant UK GDPR provisions in relation to the data subject; take into account all the circumstances of the case, including the potential vulnerability of the data subject, and so on; and apply the exemption only if the application of the particular UK GDPR provision would give rise to a substantial risk of prejudice that outweighs the risk of prejudice to the interests of the data subject, ensuring that the application of the exemption is necessary and proportionate to the risks in the particular case.

You would think it rather extraordinary that those are excluded from the previous regulations. In addition, a record must be made of the decision to apply the exemption, together with the reasons for that decision. There is also a rebuttable presumption that the data subject will be informed of the use of the exemption.

The ICO welcomed them in its letter to the Home Office as, in its view, satisfying the requirements of the Open Rights Group case. In its view, the proposed changes will ensure that the exemption complies with Article 23(2) of the UK GDPR and ensure that there are appropriate safeguards to protect individuals. Since it took part in the case as an interested party, this is of considerable reassurance. I congratulate the Open Rights Group and the3million on not one but two notable successes in court cases which have forced the Home Office to amend the exemption twice.

Data Protection: Immigration Exemption

Debate between Baroness Hamwee and Lord Clement-Jones

Monday 31st January 2022 Lords Chamber

[Baroness Hamwee (LD)]

My Lords, it is disappointing that the procedures of your Lordships’ House effectively precluded us from voting on this SI. When we debated the draft in Grand Committee, we said that we would table a regret Motion but the Government were, of course, aware of the 31 January deadline for producing a measure in response to the Court of Appeal and apparently there was no time for a regret Motion and the usual channels arranged for this take-note Motion.

The Government are obviously proper in complying with the court order in the timing, if not the content, but Parliament should have seen the draft SI earlier, had an opportunity not only to scrutinise it but to debate what it took from that scrutiny and to vote on it. I have drawn this to the attention of the chair of the Secondary Legislation Scrutiny Committee, given that committee’s and the Delegated Powers and Regulatory Reform Committee’s focus at the moment on procedures.

We are all aware of the deficiencies when we deal with secondary legislation. We knew that we would not win a vote in the Chamber because the Labour spokesman in Grand Committee supported the regulations, although we were grateful that he agreed with much of what we said during that debate. We wanted again to put our opposition on record. I thank the Minister for her explanation of the SI during that debate and I will try not to repeat too much of what was said then but will focus on the Minister’s remarks.

The Court of Appeal required the Government to amend the Data Protection Act to remedy its incompatibility with retained EU law so that it satisfies requirements of Article 23(2) of the UK GDPR. The declaration was suspended until today to provide a reasonable time to do so. That judgment was, I think, in October so they have had plenty of time. Although this is an SI amending the Act, it does not achieve that objective. The Secretary of State must have regard under the SI to the “immigration exemption policy document” and a draft IEPD was published at the same time as the draft SI.

That policy document can be amended. It can be replaced. It is not primary legislation. It is not secondary legislation. It is not legislation at all. It is not even unamendable legislation—secondary legislation cannot be amended. It is not a “legislative measure” within the terms of Article 23(2) which the Court of Appeal described as “remarkably specific”. It is not “part and parcel” of the legislation. It is not even a code of practice or a codification of safeguards; it is simply a policy document. Parliament cannot carry out a scrutiny function in which the outcome may, in theory, be changed even if we know the realities of dealing with secondary legislation. Parliament can play no meaningful part.

In Grand Committee, I asked the Minister how the policy document builds on previous arrangements, as it appears simply to repeat existing safeguards, and also for details of the Government’s consultation with interested parties and how the issues raised in consultation have been dealt with. I am grateful to her for the letter I received this afternoon, by email, in response to this—she said she would let me have the detail if it was not data protected. I am glad to note that some points were taken on board—but not all, quite clearly, because those with whom she consulted were those who brought the case to court. She said that

“the Department published the IEPD in draft form alongside the draft Regulations on the 10th December … enabling stakeholders the opportunity to consider its contents and to comment accordingly.”

Given that this policy document is central to the arrangements, I am surprised that not publishing it could ever have been thought to be an option.

In response to my question in Grand Committee, as to how one should challenge the Home Office if one does not know what it knows, or thinks it knows, to rectify errors—how would you rectify errors if you do not know that there are errors?—the Minister said that the exemption did not restrict the right to seek rectification of inaccurate data. That does not answer the question; it merely makes that question even more important. She also said that the exemption could not be used to prevent a person establishing a legal claim—which also begs the question.

It is not in contention that this data is very significant. Lord Justice Warby said the exemption

“plays a significant role in practice as a brake on access to personal data”—

one’s own data. He referred to Home Office evidence that the exemption was relied on in 59% of responses during the period in question, and that the exemption was available in a wide range of cases. The Minister in Grand Committee made much of how limited its use is and that only the minimum is redacted—only small parts of documents that contain sensitive data that could affect operations. So, I have a request and suggestion that the Home Office, in the current version of the policy document, in paragraph nine, which is a checklist for users—that is, caseworkers—should add to the list that there should be the minimum redaction. That may be implied by other parts of the document, but what caseworkers consider is crucial, and paragraph nine is what they will go to. Can the point that she made, and on which she relied, about the minimum redaction not be spelled out clearly in the checklist? I support my noble friend.

[Lord Clement-Jones (LD)]

My Lords, I want—briefly—to supplement the remarks of my noble friends. As I said in Grand Committee, I commend my noble friend Lady Hamwee for her consistent and determined opposition to this immigration exemption. During the passage of the Bill, we were not able to delete the original provisions, but we are quite clear on these benches that this new SI does not at all reflect the safeguards required by the GDPR and by the Court of Appeal’s decision. As I said in Committee, I can only wonder what kind of advice the Minister has had. How has she been able to convince herself that this SI will not meet the same fate as the previous provisions? My noble friends referred to what Lord Justice Warby had to say, and what needs to be done is extremely clear. I do not think there is any need to repeat what my noble friends have said.

It is utterly clear that the provisions being put in place do not comply with GDPR—particularly with Recital 41, and certainly not in the way Lord Justice Warby interpreted that recital. The Home Office, regardless of the law, is going forward with this new proposal with an IEPD which is simply not good enough in terms of its legislative status. As both my noble friends said, it adds nothing in the way of safeguards which were already there.

The Minister seemed to be saying in Grand Committee the Home Office had taken on board the points made by the Open Rights Group and the3million, but that she would ascertain what those points were. Sadly, I have not received a copy of the Minster’s letter, so I do not know what those points are. I hope the Minister will adumbrate those in her response this evening. It is clear that the Home Office is in great danger of having another successful judicial review against it on these regulations.

Despite our best efforts in Grand Committee, the Minister did not deal with the fundamental issue of the mechanism being used to introduce this form of exemption. We were reminded today in the Commons about what Margaret Thatcher said:

“The first duty of Government is to uphold the law. If it tries to bob and weave and duck around that duty when it’s inconvenient, if Government does that, then so will the governed and then nothing is safe—not home, not liberty, not life itself.”


Wise words. Bobbing and weaving and ducking—is that not precisely what the Government are doing on this issue?