Explanatory note

These Regulations amend the immigration exemption in Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case of R. (on the application of the 3million and Open Rights Group) v. Secretary of State for the Home Department and Secretary of State for Science, Innovation and Technology (formerly Secretary of State for Digital, Culture, Media and Sport), and The Information Commissioner as an Interested Party ([2023] EWCA Civ 1474).

The immigration exemption allows certain specific rights and obligations in the UK GDPR to be restricted to the extent that giving effect to those rights and obligations would be likely to prejudice: (a) the maintenance of effective immigration control, or (b) the investigation or detection of activities which would undermine the maintenance of effective immigration control.

The immigration exemption was amended by S.I. 2022/76 to add safeguards to the exemption.

These Regulations further amend the immigration exemption to amend the safeguards and ensure that safeguards relating to decision-making are set out on the face of the legislation.

Regulation 2 amends paragraph 4 of Schedule 2 to the 2018 Act so that it provides only for the exemption itself and the provisions of the UK GDPR to which the immigration exemption can apply (“relevant UK GDPR provisions”). It revokes the provisions relating to the immigration exemption policy document and its role in decision-making.

Regulation 3 substitutes new paragraphs 4A and 4B into Schedule 2 to the 2018 Act. Paragraph 4A sets out safeguards relating to decision-making. Paragraph 4A:

1. a)

   provides that immigration exemption decisions are made on a case by case basis;

2. b)

   provides that the Secretary of State must make a separate decision in respect of each of the relevant UK GDPR provisions which relates to the data subject;

3. c)

   provides that the Secretary of State must make a fresh decision on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions in relation to the data subject;

4. d)

   sets out essential considerations for decision-making under paragraph 4(1): that the Secretary of State takes into account all the circumstances of the case including at least any potential vulnerability of the data subject relevant to the decision, all the rights and freedoms of the data subject including the data subject’s Convention rights and any relevant duties or obligations including the UK’s obligations under the Refugee Convention and Trafficking Convention, duties under section 55 of the Borders, Citizenship and Immigration Act 2009 (c. 11) (the need to safeguard and promote the welfare of children in the United Kingdom) and the need to comply with the UK GDPR;

5. e)

   provides that a decision to apply the exemption may be made only if the application of the particular UK GDPR provision would give rise to a substantial risk of prejudice, that risk outweighs the risk of prejudice to the interests of the data subject and the application of the exemption is necessary and proportionate to the risks in the particular case.

Paragraph 4B(1) provides that the Secretary of State must keep a record of any decision that the immigration exemption applies and the reasons for that decision. Paragraph 4B(2) provides a rebuttable presumption that the data subject be informed of the use of the immigration exemption.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.