Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Considered in Grand Committee

Moved by

That the Grand Committee do consider the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.

My Lords, this instrument, which was laid before the House on 31 January 2024, would amend paragraph 4 of Schedule 2 to the Data Protection Act 2018, more commonly known as the immigration exemption. The Government are amending these provisions following the Court of Appeal judgment on 11 December 2023, which found the immigration exemption incompatible with provisions in the UK GDPR. The court suspended the effect of the judgment until 11 March 2024 to allow the Government time to make the necessary amendments.

I will briefly outline what the immigration exemption does and the changes being made by these regulations. Parliament included the immigration exemption in the Data Protection Act 2018. It provides a legal basis to derogate from certain data subject rights where their exercise is likely to prejudice effective immigration control. For example, a data subject has the right to request and receive details of what personal data is held about them and how it is being processed. Under the provisions of the immigration exemption, the Government may limit the information provided in response to that request if, for example, the provision of that information would tip off the data subject that they were about to be subject to immigration enforcement. The immigration exemption is therefore an important provision in the DPA 2018 that allows the Government to protect the functioning of the immigration system. This was noted specifically by the Court of Appeal in its judgment.

The Court of Appeal’s judgment noted two technical deficiencies in the current exemption. First, the safeguards to be applied to the immigration exemption needed to be in the legislation itself; this is being amended by the regulations’ new paragraph 4A, which inserts the safe- guards on the use of the immigration exemption previously contained in the immigration exemption policy document into the legislation.

The court also determined that the risks to rights and freedoms of individuals were not sufficiently set out in the legislation. This is being remedied by new paragraph 4A(3), which specifically sets out the rights and vulnerabilities that should be taken into account when exercising the exemption. By including these explicitly in the legislation, we are providing increased clarity on the safeguards that are already applied when exercising the provisions of the exemption.

The Government are also choosing explicitly to include provisions as to the balancing exercise that must be undertaken when determining whether the exercise of data rights is likely to prejudice effective immigration control and, if it is necessary and proportionate, to restrict such rights as a result. The draft regulations were subject to consultation with the parties to the judicial review proceedings as well as the Information Commissioner’s Office. The ICO issued a public response to the consultation confirming that it was content with the regulations.

My Lords, I thank the Minister for that explanation. I have to say that my recollection is that the issue is much wider than the exemption and ensuring that there is no tip-off to somebody who is about to be visited by immigration enforcement. Let me give an example that was borne out after the Act was passed: solicitors acting for data subjects were unable, as we had anticipated, to find out what the Home Office thought it knew—I put it that way deliberately —about their clients.

I have some general points to make; I will do so fairly quickly. It would be optimistic to think that the Home Office had taken from this saga that objections and criticisms—in the form of amendments, obviously—can be helpful because we could have avoided a lot of effort in rectification. My noble friend Lord Clement-Jones will go into some of the history; I must admit, I do not recall much detail except for being teased frequently by the noble Baroness, Lady Williams, when she was the Home Office Minister, because I brought up our objection to the immigration exemption so often.

I feel strongly that it should not have to be for non-governmental organisations that are no doubt strapped for cash to do so much in order to get things right. I appreciate that that is part of our democracy; I do not object at all to the fact that they can do so, of course, but they should not have to. An application, an appeal, another judicial review, another appeal—at what cost to those organisations and the taxpayer! I emphasise that there is an exclamation mark, not a question mark, at the end of that sentence.

This saga is one of those episodes that vindicates the role of the courts, often in language that I, for one, relish. We have spent a lot of time in the Chamber recently discussing the role of the courts in our constitution; to give one example of the language, I really liked the understated use of

My Lords, this set of regulations is a step forward, but with all the caveats that my noble friend made, and I have some more.

As the Minister confirmed, these regulations are the result of the Open Rights Group case—the Court of Appeal judgment in the3million & Anor, R (on the application of) v Secretary of State for the Home Department & Anor—which confirms the earlier High Court judgment in March 2023. In broad terms, the Court of Appeal found that the immigration exemption in Schedule 2 to the Data Protection Act 2018 conflicted with the safeguards in Article 23 of the UK GDPR, as the Minister said. This was because the immigration exemption was drafted too broadly and failed to incorporate the safeguards prescribed for exemptions under Article 23 of the UK GDPR. It was therefore held to be unlawful and was disapplied.

These regulations follow two previous attempts by the Home Office to craft an immigration exemption which contained sufficient safeguards to satisfy the requirements set out in Article 23 of the UK GDPR. This is the third shot at it. In order to make the immigration exemption compatible with the requirements of Article 23, as the Minister explained, the Government added a number of safeguards to the exemption which were not there before. These are set out in the regulations. They are worth stating because they are really important requirements, which were omitted previously.

They include requirements to: make decisions on the application of the exemption on a case-by-case basis; make separate decisions in respect of each of the relevant UK GDPR provisions which relates to the data subject; make fresh decisions on each occasion where there is consideration or restriction of any of the relevant UK GDPR provisions in relation to the data subject; take into account all the circumstances of the case, including the potential vulnerability of the data subject, and so on; and apply the exemption only if the application of the particular UK GDPR provision would give rise to a substantial risk of prejudice that outweighs the risk of prejudice to the interests of the data subject, ensuring that the application of the exemption is necessary and proportionate to the risks in the particular case.

It is a pity that the Government did not listen to my noble friend Lady Hamwee when we debated the immigration exemption during the passage of the then Data Protection Bill in 2017. I pay tribute to her tenacity in trying to ensure that this exemption is fit for purpose and compliant with the UK GDPR. We had the subsequent first version of the regulation in January 2021. If the Home Office had listened to my noble friend, it might have spared itself some grief.

In fact, it is worse than that. When we debated the Government’s attempt to comply with the first court judgment back in January 2022, my then noble friend Lord Paddick—who is still my actual friend—my noble friend Lady Hamwee and I all warned that the method they were adopting would be non-compliant with Article 23(2) and the judgment of October 2021. I explicitly said that

“we are quite clear on these Benches that this new SI does not at all reflect the safeguards required by the GDPR and by the Court of Appeal’s decision … I can only wonder what kind of advice the Minister has had. How has she”—

this was the noble Baroness, Lady Williams, as my noble friend referred to—

“been able to convince herself that this SI will not meet the same fate as the previous provisions?”—[Official Report, 31/1/22; col. 698.]

Finally, it seems that we have compliance, six years after Royal Assent. What have the total legal costs been in all the legal challenges? I ask that with a question mark rather than my noble friend’s exclamation mark. The barristers’ bills must have come in by now. If the Minister does not have them to hand, will he write? I hope that there are several red faces in the Home Office, but I am afraid that this is all of a piece with its approach to border and immigration policy, which has been even more exposed than usual in recent days, with the publication of the former chief inspector’s reports.

What reflections does the Minister have on this saga, as my noble friend rightly described it? Is there any intent to change how the Home Office goes about compliance with law, the advice it takes and the judgments it makes on that advice? My noble friend asked about transparency in future and the report of the Secondary Legislation Scrutiny Committee, which is still not totally satisfied with these regulations. There is a whole series of questions about the human impact of the use of this illegal exemption since it was created. How many individuals have been impacted and in what respect? What redress do they have? As my noble friend asked, why has there been no impact assessment? Surely, the human impact has been considerable.

That is not the sum total of the implications of these regulations. In truth—I am indebted to Bates Wells for its analysis of this—the effect of these regulations is significant and not confined to the field of immigration. The regulations are clear evidence of how data protection rights and standards in the UK have been weakened as a result of the Retained EU Law (Revocation and Reform) Act 2023, or REULA. The Government could easily restore data protection rights to what they were before the end of 2023 using the vehicle of the Data Protection and Digital Information Bill, which we will start debating in Committee on 20 March. This would help ensure trust in the UK’s data protection standards and support, rather than undermine the Government’s efforts to make the UK what they aspire for it to be—a “technology superpower” by the end of this decade.

When the UK stopped being subject to EU law at the end of 2020, the European Union (Withdrawal) Act—EUWA—saved EU rights and obligations that applied in the domestic statute book as a result of the UK’s EU membership. This meant that the GDPR was retained as domestic law and was renamed the UK GDPR. The Data Protection Act 2018 also continued to apply. Importantly, EUWA also preserved the relationship between existing domestic laws and what had been EU law by keeping the principle of the supremacy of EU law on the statute book. This simply ensured that the relationship between different parts of the UK’s domestic law remained as before, thus creating continuity and certainty. In terms of data protection law, this meant, for instance, that in a conflict between the UK GDPR and the DPA 2018, the UK GDPR would take precedence.

However, at the end of 2023, REULA deleted the principle of the supremacy of EU law and turned the statute book on its head. Domestic law, whenever enacted, now takes precedence over the parts of the domestic statute book that were previously EU law. There are exceptions to this rule, but they do not apply to the relationship between the DPA 2018 and the UK GDPR. The Open Rights case, which has culminated in the Government drafting these regulations, was brought after the UK left the EU but before the relevant provisions of REULA came into effect. It is an example of how the preservation of the principle of the supremacy of EU law continued to guarantee high standards of data protection. In a conflict between the DPA 2018 and the UK GDPR, the DPA 2018 will now take precedence —the opposite of what parliamentary draftsmen intended when the provisions of the Act were written and a change which clearly lowers the standard for the protection of personal data in the UK.

The safeguards that will be in place for data subject rights in an immigration context will now be far more extensive than the protections that exist in other areas. For example, where personal data is being processed for the prevention or detection of crime, the apprehension or prosecution of offenders or the assessment or collection of a tax or duty, a controller will not need to be nearly as meticulous in applying safeguards as they would be in an immigration context. The same is true where personal data is being processed for other purposes, including discharging regulatory functions relating to legal services, health services and children’s services or by public bodies in discharging their statutory functions.

Before the end of 2020, it would have been possible to bring a challenge to other exemptions in Schedule 2 to the DPA 2018 based on the same arguments that were successfully advanced in the Open Rights case: that the exemptions in Schedule 2 are incompatible with the requirement for protections as set out in Article 23 of the UK GDPR and are therefore unlawful and must be made more protective in the interests of data subjects. REULA removes this ground of challenge because it is now impossible to argue that the exemptions under the DPA must comply with the safeguards set out in Article 23 of the UK GDPR. This is because the removal of the principle of the supremacy of EU law and the new rule introduced by REULA means that any inconsistency between the UK GDPR and the DPA 2018 must be resolved in favour of the provisions of the DPA. In other words, the broad exemptions under the DPA trump the safeguards in the UK GDPR, thus making the safeguards inapplicable.