Draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Tom Pursglove Excerpts

Wednesday 28th February 2024 General Committees

[The Minister for Legal Migration and the Border (Tom Pursglove)]

I beg to move,

That the Committee has considered the draft Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.

It is a pleasure to serve under your chairmanship, Ms Vaz. This statutory instrument, which was laid before the House on 31 January, will amend paragraph 4 of schedule 2 to the Data Protection Act 2018, more commonly known as the immigration exemption. Members are likely to be aware that the Government are amending the provisions following the Court of Appeal judgment of 11 December 2023. The judgment was a result of judicial review and the court found the immigration exemption incompatible with provisions in the UK GDPR. The court suspended the effect of the judgment until 11 March 2024.

I will briefly outline what the immigration exemption does and the changes that the Government are making in response to the Court of Appeal’s judgment. Parliament included the immigration exemption in schedule 2 to the Data Protection Act. The exemption provides a legal basis to derogate from certain data subject rights where their exercise would be likely to prejudice effective immigration control. For example, the data subject has the right to request and receive details of what personal data is held about them and how it is being processed, commonly known as a subject access request.

Under the provisions of the immigration exemption the Government may limit the information provided in response to a request if the provision of that information would prejudice effective immigration control—for example, if it tipped off the data subject about a likely immigration visit. The immigration exemption is therefore an important provision in the DPA 2018, which allows the Government to protect the functioning of the immigration system. That was noted specifically by the Court of Appeal in its judgment.

The Court of Appeal noted two technical deficiencies in the current exemption in its judgment. First, the safeguards to be applied to the immigration exemption needed to be in the legislation itself. That is being amended by new paragraph 4A in the regulations, which inserts on to the face of the legislation the safeguards on the use of the immigration exemption previously contained in the immigration exemption policy document.

The Court also determined that the risks to rights and freedoms of individuals were not sufficiently set out in the legislation. That is being remedied by new paragraph 4A(3) in the regulations, which specifically sets out the rights and vulnerabilities that should be taken into account when exercising the exemption. By including those explicitly in the legislation we are providing increased clarity on the safeguards that are already applied when exercising the provisions of the exemption.

The Government are also choosing to explicitly include provisions on the balancing exercise that must be undertaken when determining whether the exercise of data rights is likely to prejudice effective immigration control and if it is necessary and proportionate to restrict such rights as a result. The draft regulations were subject to consultation with the parties to the judicial review proceedings as well as the Information Commissioner’s Office. The ICO issued a public response to the consultation confirming it was content with the regulations.

The Government have acted to meet the requirements of the Court of Appeal’s judgment while continuing to ensure there are necessary safeguards in the legislation to protect effective immigration control. I therefore commend the draft regulations to the Committee.

--- Later in debate ---

[Tom Pursglove]

I thank colleagues from across the House for their various questions, which I will gladly respond to in winding up the debate. The first was from the hon. Member for Nottingham North about whether we consider this to be the end of the matter. He will appreciate that it is never possible to guard against any individual bringing forward a case if that is what they choose to do. However, I can say that we are confident that the exemption addresses the issues that the Court identified in its judgment in full. That view is also shared by the ICO, as I set out in my opening remarks, which has publicly stated that it is content with the regulations.

That links to the issue of consultation and engagement, and there are a number of questions around that. The claimants were consulted as part of the development of the provisions and they made some additional suggestions. Beyond that, the Court of Appeal gave a three-month period for the Government to amend the exemption, after which it would be unlawful. We are of course complying with that judgment, and that is reflected in the statutory instrument before us. A full public consultation was therefore impossible, but, as I said, consultation took place with the ICO, the claimants in the case, the Open Rights Group and the3million. Given the nature of the judgment and the changes required, the Government did not consider it necessary to consult more widely.

[Alison Thewliss]

The Minister says that the3million and the Open Rights Group were consulted and made suggestions. Did the Government make any changes as a result of those suggestions?

[Tom Pursglove]

It is fair to say that we as the Government have reflected on the conversations that we have had, and the regulations we are debating reflect those conversations. As I say, the ICO is clear about its stance in being in adherence with the outcome of the court case. That is important to acknowledge in relation to this.

On the specific question of costs, I cannot commit to giving a specific figure today. However, once all the costings around the case have been settled and the process has been settled and finalised in the usual way, I can most certainly provide a figure to the House.

There was a perfectly legitimate question about how data subjects know that the exemption has been used. The exemption includes a presumption that data subjects are to be informed where the exemption provisions have been applied in their case, unless informing the data subject of the application would in itself prejudice the purpose of the exemption. Linked to that was an inquiry about the use of the exemption. For the year ending October 2023, the immigration exemption was applied to about 70% of subject access requests received in relation to immigration, citizenship and Border Force. Of those, the vast majority had only a small amount of data redacted under the use of the exemption.

Rightly, there were also questions around safeguards. To be clear, the Court of Appeal judgment was specific in the areas that it deemed the immigration exemption to be incompatible with UK GDPR. This statutory instrument addresses comprehensively those issues, and the safeguards are set out clearly on the face of the legislation. The immigration exemption needs to be flexible in order to account for a range of scenarios, and going into more detail in the legislation risks compromising both the purpose of the exemption and the rights of data subjects, as I am sure the Committee will understand.

However, in recognition of that, routes of redress exist for data subjects, with the standard routes of redress being where a data subject feels that the immigration exemption has applied to them wrongly. Those data subjects may complain to the Home Office as the data controller, and they can also contact the ICO, which has appropriate powers to investigate instances of non-compliance with data protection law. In addition to contacting the ICO, data subjects can legally challenge an application of the immigration exemption in the courts.

[John McDonnell]

Before the Minister sits down—

[Tom Pursglove]

I have already sat down, I am afraid.

[John McDonnell]

It would be useful if you answered the questions that were put to you.