EU citizens have won the right to get full access to records about them held by the Home Office or any other body after a legal battle by campaigners.
Three judges at the court of appeal unanimously overturned an earlier high court decision that their case had no legal merit and ruled the Data Protection Act 2018 (DPA) unlawfully denied them access to their data through an “immigration exemption” clause.
It brings to an end a three-year challenge by campaign groups the3million and the Open Rights Group.
The ruling means EU citizens who are denied settled status or future immigration visas can have full access to Home Office databases to see records used against them that could include social benefits, entry to the country records, criminal and civil offence records.
Open Rights Group said it was a “momentous day” and lawyers at Leigh Day, which represented the groups, said it would have far-reaching implications for data controllers across the public and private sector including landlords, banks and employers.
The lord justices Underhill, Singh and Warby ruled on Wednesday that the immigration exemption in the DPA was “non-compliant” with the General Data Protection Regulation (GDPR) and the charter of fundamental rights of the EU.
They sided with those who submitted evidence in 2016 that 10% of the Home Office’s database of individuals identified as a “disqualified person” was wrong and that almost half the appeals against their decision before the DPA came into effect were successful.
“The fact that the Home Office deal imperfectly with ‘Windrush generation’ is a matter of common knowledge,” they noted.
The Open Rights Group and the3million had failed in their attempt to overturn the immigration exemption in the DPA in a judicial review in 2018, arguing it undermined their legal right to challenge decisions by the Home Office.
The exemption meant an EU citizen seeking to challenge a decision to refuse settled status or future leave to remain in the UK was automatically handicapped because they did not have access to the records used against them. The Home Office had argued the law was necessary.
But the case lifted the lid on the secretive decision-making processes in the Home Office, with case workers using a “prejudice test” for the “maintenance of effective immigration control”.
The judgment ruled against the Home Office’s consideration that immigration control policies “outweighed the benefits of the individual exercising their data subject rights”.
The judges noted that in the first year of the DPA coming into force, the Home Office relied on the immigration exemption rule in 10,823, or 59%, of cases.
Sahdya Darr, Open Rights Group’s immigration policy manager, said the judges had “recognised that the immigration exemption drives a huge hole through data protection law”. She added that public bodies should be allowed to deny subject access requests only in “exceptional circumstances ... such as during a criminal investigation”.
Maike Bohn, the co-founder of the3million, welcomed the judgment. “As it stands, the exemption from data protection for foreign nationals hands all the cards to unaccountable parties – a recipe for things to go horribly wrong.”
The judges have ruled that further legal argument must follow to establish what remedies must be put in place.
“Winning the appeal means we can hopefully reintroduce much-needed scrutiny so errors and data misuse cannot go undetected,” said Bohn.
