UK immigration exemption under the DPA2018 ruled unlawful

On Wednesday, 29 March, a High Court judge ruled the immigration exemption contained within Schedule 2 of the UK Data Protection Act 2018 is incompatible with Article 23 of the UK General Data Protection Regulation (GDPR). The landmark ruling brought by the Open Rights Group (ORG) and the3million is the second time the UK government has been taken to court over the immigration exemption. The ORG press release called the ruling "a victory for migrants’ data rights in an increasingly hostile environment in the UK, where migrants are treated as second class citizens." 

Meg Foulkes, Head of Policy and Litigation at ORG, is disappointed to have had to go to court again. However, now that the courts have ruled in their favour: "The Government must now ensure that the Home Office and private companies that are contracted to enforce immigration control comply with GDPR. The data they process can lead to life-altering decisions and it’s vital that the system is fair and transparent," she said.

The Information Commissioner's Office (ICO) issued a statement in response. As an interested party in the claim, the ICO had raised concerns over previous actions and guidance from the government concerning the exemption. 

John Edwards, Information Commissioner, said, "Clarity in what the law requires is crucial for it to function well. The changes this judgment requires will bring greater certainty, which will allow for effective immigration processes while supporting people’s rights."