Draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 Debate
Full Debate: Read Full DebateJohn McDonnell
Main Page: John McDonnell (Independent - Hayes and Harlington)I refer to paragraph 6.11 in the explanatory notes, which notes the insertion of new paragraph 4A(4). I am working on the basis that this is the Government acknowledging that, following the Court case, some form of compromise has to be reached with every party involved.
The issue that has concerned many of us in the past was balancing the risk between the operation of immigration controls and the individual’s rights. I welcome the Minister’s reassurance, and I speak on the basis that these regulations are the compromise. The new paragraph explains that the balance of risk relates to whether there is a substantial risk of prejudice either way. Therefore, the individual and the operation of the immigration control mechanism are both protected. Obviously, some of that will now be developed by case law decisions on the balance of risk, but it may well be challenged in future. First, did all parties to the court case sign up to the very specific wording of the compromise?
Secondly, we have had problems with this in the past, so how can we monitor its operation in future and how will that be reported through the system and into Parliament? This is not to be oppositional in any form, but learning lessons from the operation of such new procedures may mean that we want to adjust the process in future. It behoves Parliament to take a particular interest in monitoring the operation of this new compromise—and I hope that it is a compromise—that has been agreed.
It is fair to say that we as the Government have reflected on the conversations that we have had, and the regulations we are debating reflect those conversations. As I say, the ICO is clear about its stance in being in adherence with the outcome of the court case. That is important to acknowledge in relation to this.
On the specific question of costs, I cannot commit to giving a specific figure today. However, once all the costings around the case have been settled and the process has been settled and finalised in the usual way, I can most certainly provide a figure to the House.
There was a perfectly legitimate question about how data subjects know that the exemption has been used. The exemption includes a presumption that data subjects are to be informed where the exemption provisions have been applied in their case, unless informing the data subject of the application would in itself prejudice the purpose of the exemption. Linked to that was an inquiry about the use of the exemption. For the year ending October 2023, the immigration exemption was applied to about 70% of subject access requests received in relation to immigration, citizenship and Border Force. Of those, the vast majority had only a small amount of data redacted under the use of the exemption.
Rightly, there were also questions around safeguards. To be clear, the Court of Appeal judgment was specific in the areas that it deemed the immigration exemption to be incompatible with UK GDPR. This statutory instrument addresses comprehensively those issues, and the safeguards are set out clearly on the face of the legislation. The immigration exemption needs to be flexible in order to account for a range of scenarios, and going into more detail in the legislation risks compromising both the purpose of the exemption and the rights of data subjects, as I am sure the Committee will understand.
However, in recognition of that, routes of redress exist for data subjects, with the standard routes of redress being where a data subject feels that the immigration exemption has applied to them wrongly. Those data subjects may complain to the Home Office as the data controller, and they can also contact the ICO, which has appropriate powers to investigate instances of non-compliance with data protection law. In addition to contacting the ICO, data subjects can legally challenge an application of the immigration exemption in the courts.