Data Protection: Immigration Exemption

Lord Clement-Jones Excerpts

Monday 31st January 2022 Lords Chamber

[Baroness Hamwee (LD)]

My Lords, it is disappointing that the procedures of your Lordships’ House effectively precluded us from voting on this SI. When we debated the draft in Grand Committee, we said that we would table a regret Motion but the Government were, of course, aware of the 31 January deadline for producing a measure in response to the Court of Appeal and apparently there was no time for a regret Motion and the usual channels arranged for this take-note Motion.

The Government are obviously proper in complying with the court order in the timing, if not the content, but Parliament should have seen the draft SI earlier, had an opportunity not only to scrutinise it but to debate what it took from that scrutiny and to vote on it. I have drawn this to the attention of the chair of the Secondary Legislation Scrutiny Committee, given that committee’s and the Delegated Powers and Regulatory Reform Committee’s focus at the moment on procedures.

We are all aware of the deficiencies when we deal with secondary legislation. We knew that we would not win a vote in the Chamber because the Labour spokesman in Grand Committee supported the regulations, although we were grateful that he agreed with much of what we said during that debate. We wanted again to put our opposition on record. I thank the Minister for her explanation of the SI during that debate and I will try not to repeat too much of what was said then but will focus on the Minister’s remarks.

The Court of Appeal required the Government to amend the Data Protection Act to remedy its incompatibility with retained EU law so that it satisfies requirements of Article 23(2) of the UK GDPR. The declaration was suspended until today to provide a reasonable time to do so. That judgment was, I think, in October so they have had plenty of time. Although this is an SI amending the Act, it does not achieve that objective. The Secretary of State must have regard under the SI to the “immigration exemption policy document” and a draft IEPD was published at the same time as the draft SI.

That policy document can be amended. It can be replaced. It is not primary legislation. It is not secondary legislation. It is not legislation at all. It is not even unamendable legislation—secondary legislation cannot be amended. It is not a “legislative measure” within the terms of Article 23(2) which the Court of Appeal described as “remarkably specific”. It is not “part and parcel” of the legislation. It is not even a code of practice or a codification of safeguards; it is simply a policy document. Parliament cannot carry out a scrutiny function in which the outcome may, in theory, be changed even if we know the realities of dealing with secondary legislation. Parliament can play no meaningful part.

In Grand Committee, I asked the Minister how the policy document builds on previous arrangements, as it appears simply to repeat existing safeguards, and also for details of the Government’s consultation with interested parties and how the issues raised in consultation have been dealt with. I am grateful to her for the letter I received this afternoon, by email, in response to this—she said she would let me have the detail if it was not data protected. I am glad to note that some points were taken on board—but not all, quite clearly, because those with whom she consulted were those who brought the case to court. She said that

“the Department published the IEPD in draft form alongside the draft Regulations on the 10th December … enabling stakeholders the opportunity to consider its contents and to comment accordingly.”

Given that this policy document is central to the arrangements, I am surprised that not publishing it could ever have been thought to be an option.

In response to my question in Grand Committee, as to how one should challenge the Home Office if one does not know what it knows, or thinks it knows, to rectify errors—how would you rectify errors if you do not know that there are errors?—the Minister said that the exemption did not restrict the right to seek rectification of inaccurate data. That does not answer the question; it merely makes that question even more important. She also said that the exemption could not be used to prevent a person establishing a legal claim—which also begs the question.

It is not in contention that this data is very significant. Lord Justice Warby said the exemption

“plays a significant role in practice as a brake on access to personal data”—

one’s own data. He referred to Home Office evidence that the exemption was relied on in 59% of responses during the period in question, and that the exemption was available in a wide range of cases. The Minister in Grand Committee made much of how limited its use is and that only the minimum is redacted—only small parts of documents that contain sensitive data that could affect operations. So, I have a request and suggestion that the Home Office, in the current version of the policy document, in paragraph nine, which is a checklist for users—that is, caseworkers—should add to the list that there should be the minimum redaction. That may be implied by other parts of the document, but what caseworkers consider is crucial, and paragraph nine is what they will go to. Can the point that she made, and on which she relied, about the minimum redaction not be spelled out clearly in the checklist? I support my noble friend.

[Lord Clement-Jones (LD)]

My Lords, I want—briefly—to supplement the remarks of my noble friends. As I said in Grand Committee, I commend my noble friend Lady Hamwee for her consistent and determined opposition to this immigration exemption. During the passage of the Bill, we were not able to delete the original provisions, but we are quite clear on these benches that this new SI does not at all reflect the safeguards required by the GDPR and by the Court of Appeal’s decision. As I said in Committee, I can only wonder what kind of advice the Minister has had. How has she been able to convince herself that this SI will not meet the same fate as the previous provisions? My noble friends referred to what Lord Justice Warby had to say, and what needs to be done is extremely clear. I do not think there is any need to repeat what my noble friends have said.

It is utterly clear that the provisions being put in place do not comply with GDPR—particularly with Recital 41, and certainly not in the way Lord Justice Warby interpreted that recital. The Home Office, regardless of the law, is going forward with this new proposal with an IEPD which is simply not good enough in terms of its legislative status. As both my noble friends said, it adds nothing in the way of safeguards which were already there.

The Minister seemed to be saying in Grand Committee the Home Office had taken on board the points made by the Open Rights Group and the3million, but that she would ascertain what those points were. Sadly, I have not received a copy of the Minster’s letter, so I do not know what those points are. I hope the Minister will adumbrate those in her response this evening. It is clear that the Home Office is in great danger of having another successful judicial review against it on these regulations.

Despite our best efforts in Grand Committee, the Minister did not deal with the fundamental issue of the mechanism being used to introduce this form of exemption. We were reminded today in the Commons about what Margaret Thatcher said:

“The first duty of Government is to uphold the law. If it tries to bob and weave and duck around that duty when it’s inconvenient, if Government does that, then so will the governed and then nothing is safe—not home, not liberty, not life itself.”


Wise words. Bobbing and weaving and ducking—is that not precisely what the Government are doing on this issue?

--- Later in debate ---

Recital 41 applies to legislative measures, and as such—

[Lord Clement-Jones (LD)]

My Lords, if I may interrupt the Minister, Lord Justice Warby’s decision on that is utterly clear about what Recital 41 does require. That is precisely the point of contention.

[Baroness Williams of Trafford (Con)]

My Lords, it is, but it does not specify by way of form or content of the legislative measure, and that is the point I am trying to make.

[Lord Clement-Jones (LD)]

But it has to be a legislative measure, not guidance.

[Baroness Williams of Trafford (Con)]

Perhaps I could reiterate that Recital 41 states that:

“Where this Regulation refers to a legal basis or a legislative measure, this does not necessarily require a legislative act adopted by a parliament”.


We will beg to differ on that, but I am just quoting what Recital 41 says.

To address the court’s concerns, the regulations therefore amend the immigration exemption, primarily to include all the relevant matters in Article 23(2)(a) to (h) of the UK GDPR. It might be helpful if I provide some details on those matters that are not relevant and are already covered in the DPA 2018. For those particular matters, no amendments are needed to the legislation, as well as for those matters that are not relevant. I will provide some details on the measures that are relevant and for which amendments have been made.

Before I do that, I point out that the regulations introduced a statutory requirement for the department to have an immigration exemption policy document before the immigration exemption could actually be applied—that is in response to the noble Lord, Lord Paddick. Regulation 2(2)(b) specified what must be addressed in the policy, and the controller must have regard to it. In answer to the noble Baroness, Lady Hamwee, we are working to tighten the deadlines set by the court, and we did publish the IEPD draft on 10 December on GOV.UK.

Continuing now on what is and is not relevant, the following limbs of Article 23(2) are already sufficiently covered in the DPA 2018. Therefore, no amendments will be made to the legislation in relation to those limbs. They are, from Article 23(2):

“(a) the purposes of the processing or categories of processing; (b) the categories of personal data; (c) the scope of the restrictions introduced … (g) the risks to the rights and freedoms of data subjects”.


The requirement under Article 23(2)(f) to make provision in respect of

“the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing”

is not relevant, as the immigration exemption does not purport to extend data storage periods, and so no amendments are proposed in this regard.

On amendments made in relation to Article 23(2)(d), including the IEPD, the article states that where relevant there shall be provisions for safeguards to prevent abuse or unlawful access or transfer. This instrument will introduce additional measures to address Article 23(2)(d). It will mandate the Secretary of State to have an immigration exemption policy document in place prior to the exemption being relied on; that they must have regard to their IEPD when applying the exemption; that a record is kept of the application of the immigration exemption; and that the data subject be informed of its application, save in certain circumstances.

The IEPD and any subsequent updates to it will be published in a manner that the Secretary of State considers appropriate. Publication will allow for flexibility, where future concerns arise—I will take back the comments that the noble Baroness, Lady Hamwee, made this evening. There is no requirement to go through Parliament and any future concerns, if they arise, could be addressed in a shorter timeframe.

The regulations also specify what the IEPD must address. This additional measure will promote high standards of safeguards in applying the immigration exemption, consistent with those in relation to personal data relating to criminal convictions and offences. The IEPD explains how the immigration exemption must be operationally applied and the circumstances in which data rights might be exempted. These are set out in clear and precise terms. They will form part of Schedule 2 to the DPA 2018 once in force and, as such, will clearly constitute legislative measures.

Amendments are also made to Article 23(2)(e), on provisions as to the specification of the controller or categories of controllers, and to Article 23(2)(h), which states that where relevant there shall be provisions for the right of a data subject to be informed about the restriction, unless that is prejudicial to the purposes of the restriction—we went through that during the previous debate. The instrument will amend the immigration exemption so that the controller will have to inform the data subject that the exemption has been relied upon unless to do so would prejudice the purpose of the restriction, once again proving our commitment to be as open and transparent as we are able.

I am not sure whether it was the noble Baroness or the noble Lord who asked about the consultation process, but they almost played my words back to me. We consulted the parties to the litigation and the ICO and considered carefully their observations and comments, making amendments to the draft as appropriate, but clearly we did not take everyone’s comments on board, and therefore the court process came into being. We have tried, as far as possible, to address the issues through the IEPD.

I hope that noble Lords are now satisfied—I do not think they are, judging by their faces. I shall leave it there.