“Immigration exemption” ruled unlawful under GDPR

When the “immigration exemption” became law as part of the 2018 Data Protection Act, it threatened the data rights of all UK residents, including British citizens. Open Rights Group and the3million responded by taking the Government to court.

We argued before the UK High Court that the exemption, used by the Home Office to deny people access to their personal data, is far too broad and imprecise. Administrative errors are notoriously common in immigration cases, but if residents can’t access their own data they’ll have little chance of overturning mistakes.

In October 2019 the judge ruled against our challenge, but we succeeded in pushing the Home Office to reveal it used the exemption in 60% of immigration-related requests for data. The Home Office also pledged to inform all future data subjects whenever they use the exemption. 

Victory on appeal!

With the help of our supporters, funding for an appeal was raised and on 26 May 2021 the court of appeal unanimously found that the UK immigration exemption is incompatible with Article 23 of the GDPR.

Our work on the immigration exemption has led to the new Immigration, Data and Technology project.