Right to access personal data held by Home Office

After a legal battle by campaigners, EU citizens have won the right to get full access to records about them held by the Home Office, or any other body.

Three judges at the court of appeal unanimously overturned an earlier high court decision that their case had no legal merit and ruled the Data Protection Act 2018 (DPA) unlawfully denied them access to their data through an ‘immigration exemption’ clause.

This brings to an end a three year challenge by campaign groups the 3million and the Open Rights Group.

The ruling mean that EU citizens who are denied settled status or future immigration visas can have full access to Home Office databases to see records used against them that could include social benefits, entry to the country records, criminal and civil offence records.

Open Rights Group said it was a ‘momentous day’ and lawyers at Leigh Day, which represented the groups, said it would have far reaching implications for data controllers across the public and private sector, including landlords, banks and employers.

The lord justices Underhill, Singh and Warby ruled that the immigration exemption in the DPA was ‘non-compliant’ with the General Data Protection Regulation (GDPR) and the charter of fundamental rights of the EU.

They sided with those who submitted evidence in 2016 that 10% of the Home Office’s database of individuals identified as a ‘disqualified person’ was wrong and that almost half of the appeals against their decision before the DPA came into effect were successful.

“The fact that the Home Office dealt imperfectly with ‘Windrush generation’ is a matter of common knowledge’, they noted.

The Open Rights Group and the 3million had failed in their attempt to overturn the immigration exemption in the DPA in a judicial review in 2018, arguing it undermined their legal right to challenge decisions by the Home Office.

The exemption meant a EU citizen seeking to challenge a decision to refuse settled status or future leave to remain in the UK was automatically handicapped because they did not have access to the records used against them. The Home Office had argued the law was necessary.

However, the case lifted the lid on the secretive decision-making progress in the Home Office, with case workers using a ‘prejudice test’ for the ‘maintenance of effective immigration control’.

The judgement ruled against the Home Office’s consideration that immigration control policies ‘outweighed the benefits of the individual exercising their data subject rights’.

The judges noted that in the first year of the DPA coming into force, the Home Office relied on the immigration exemption rule in 10,823 or 59% of cases.

Open Rights Group’s immigration policy manager, Sahdya Darr, said the judges had: “recognised that the immigration exemption drives a huge hole through data protection law”.  She added that public bodies should be allowed to deny subject access requests only in ‘exceptional circumstances’, such as a criminal investigation.

The co-founder of the 3million, Maike Bohn, welcomed the judgement.  “As it stands, the exemption from data protection for foreign nationals hands all the cards to unaccountable parties – a recipe for things to go horribly wrong”.

The judges have ruled that further legal argument must follow to establish what remedies must be put into place.

“Winning the appeal means we can hopefully reintroduce much needed scrutiny so errors and data misuse cannot go undetected”.