High Court rejects challenge to Data Protection Act’s immigration exemption

The High Court has ruled that the immigration exemption under the Data Protection Act 2018 (“DPA”) is lawful (R (Open Rights Group & the3million) v Secretary of State for the Home Department]).

What is the immigration exemption? 

Data controllers can rely on exemptions within the DPA (and GDPR) as a basis for not complying with certain GDPR obligations, including for example not providing information in response to a data subject access request. 

Data controllers can rely on the immigration exemption where they are processing personal data in order to maintain “effective immigration control” (or in order to investigate or detect activities that would undermine the maintenance of effective immigration control) if complying with their DPA/GDPR obligations would be likely to prejudice these matters. For example, they can rely on this exemption as a basis for not providing information in response to a data subject access request. 

Subject access requests can be an important tool where an individual’s immigration application has been refused and they are considering an appeal. The Home Office may rely on the immigration exemption in order to refuse to provide personal data in response to a request. 

How did campaign groups challenge the exemption?

Campaign groups the3million (who campaign for EU27 citizens living in the UK) and the Open Rights Group (who campaign on digital rights issues) challenged the exemption. They brought an application for judicial review, arguing the exemption was too broad. 

What was the High Court's ruling?

The High Court rejected their arguments, finding the immigration exemption lawful. It considered that “the purposes for which, and the categories of data to which, it may be applied were…appropriately delineated”.

The3million and Open Rights Group have sought permission to appeal. 

What will be the impact of this case? 

The immigration exemption was one of the more contentious elements of the DPA when it was introduced. It was not found in the previous Data Protection Act (DPA 1998). Interestingly, the judgment noted that of around 18,000 data subject requests received in the DPA’s first year, the immigration exemption was relied on to prevent disclosure (of part, or the whole of, a file) in 59% of cases. Had the challenge been successful, this would have had significant implications for a number of data controllers. The outcome of any appeal is therefore awaited with interest.