Landmark victory: UK court rules immigration data exemption unlawful

The Immigration Exemption, impacting individuals who have interacted with the Home Office, poses a challenge to data protection rights granted by the Data Protection Act 2018. This legislation empowers people to exercise control over their personal data, facilitating the right to access information through Subject Access Requests (SARs). Referred to as a 'gateway right,' this knowledge allows individuals to assert their other data protection rights, encompassing protection from decisions based solely on automated processing. Despite inherent limitations, the Immigration Exemption further curtails these rights when the Home Secretary deems them obstructive to "effective immigration control."

The legal challenge against the Immigration Exemption centres on the contention that insufficient safeguards and risk considerations are outlined in the legislation. Notably, the Home Office has mandated a policy document with relevant safeguards, but this document, not incorporated into the legislation, is subject to ministerial alterations without parliamentary scrutiny. The Court of Appeal's unequivocal judgment on December 11, 2023, deems the Immigration Exemption incompatible with the Data Protection Act 2018. The court has granted the government a three-month period to rectify the legislation, highlighting concerns about the lack of transparency regarding additional safeguards outlined in a separate document that can be altered at the Secretary of State's discretion.