Moved by Baroness Ludford
43: After Clause 4, insert the following new Clause—“Data protection: immigration (EEA and Swiss nationals) (1) The Data Protection Act 2018 is amended in accordance with subsection (2).(2) In paragraph 4 of Schedule 2, after sub-paragraph (4) insert—“(5) This paragraph does not apply if the data subject is an EEA or Swiss national.””Member’s explanatory statementThis new Clause would ensure that the immigration exemption in the Data Protection Act 2018 does not apply to EEA or Swiss nationals.
My Lords, I beg to move Amendment 43 in my name and that of my noble friend Lady Hamwee, and to speak to other amendments in this group. Amendment 43 seeks to remove paragraph 4 of Schedule 2 to the Data Protection Act in relation to EEA and Swiss nationals, and there is a reason why it is drafted only in relation to EAA and Swiss nationals.
These Benches and others have consistently opposed the suppression of data protection rights of migrants and free movers, which paragraph 4 of Schedule 2 imposes. My noble friend Lady Hamwee made a very powerful speech when moving an amendment on Report of the Data Protection Bill to remove said paragraph, which she said was “very far-reaching indeed” and even
“gives scope for quite considerable fishing expeditions.”—[
One of the safeguards lacking from the Data Protection Act is the protection of Article 8, on data processing, of the EU Charter of Fundamental Rights. Because the Government refused to include the charter as retained EU law on exit, all we have is the European Convention on Human Rights, and once again there are rumblings about the ECHR. Yesterday, the headline in the Sunday Telegraph—I had to go out and buy it, which was rather galling, because it is behind a paywall—was:
“Boris Johnson set to opt out of human rights laws” and that meant the convention. Here we go again. The Sunday Telegraph reported that Mr Dominic Cummings, no less, has previously attacked the European Court of Human Rights, and
“has warned that voters would expect the jurisdiction of European judges to end in the UK as part of the Brexit process”— those pesky European judges. At least the newspaper had the grace to add that the ECHR and court were not part of the EU system, but there is that attempt to cross over and interlink the whole time. There is a connection between the UK’s adherence to the European Convention on Human Rights and the Brexit process, in the sense that the Government are resisting giving the EU a formal undertaking to adhere to the convention. The Justice Secretary told a radio programme this weekend:
“The idea that we’re going to leave the convention is for the birds.”
The trouble is, one might have thought the same about the idea that the Government might renounce part of the withdrawal agreement—until they did, in the Bill being debated in the other place this afternoon. Indeed, in April 2016, the then Home Secretary, Theresa May, said:
“The case for remaining a signatory of the European Convention on Human Rights, which means Britain is subject to the European court, is not clear.”
She said the case was not clear and she, of course, was subsequently Prime Minister.
The deputy counsel to the Joint Committee on Human Rights advised that implementing the GDPR—the general data protection regulation, the EU’s data protection law—would arguably not be enough on its own to ensure a data adequacy finding for the UK if the Data Protection Bill fell short of standards required by Article 8 of the charter. You can double this if our membership of the European Convention on Human Rights is also at risk. The knock-on effect if the UK fails to get a data adequacy decision will mean that the prospects for law enforcement co-operation with the EU, or business transfers of data to EU and EEA countries, will be dim indeed. This point was made repeatedly in proceedings on the Data Protection Bill and, indeed, on various Brexit Bills in this House. The weakness of human rights safeguards makes the loss of data protection rights for migrants even more significant.
Paragraph 4 of Schedule 2 to the Data Protection Act 2018 is unnecessary and disproportionate. Other provisions in Schedule 2 allow exemption from data protection rights in relation to criminal immigration offences, so that point would anyway be covered. The Equality and Human Rights Commission said that the exemption from data protection rights for migrants could
“permit the authorities to access and process highly personalised data, for example, phone or social media relating to sexual lives of immigrants claiming residency rights on the basis of their relationship with a British citizen.”
The data-sharing agreements that the Home Office has with other departments, plus the ability of private persons—such as landlords, employers, bank staff and so on, which was discussed in the last group—to access data mean that the scope of the immigration exemption from data protection rights is very wide indeed, with a commensurate breadth of potential harm to individuals. Strangely, the Government amended the Data Protection Bill to allow a person to rectify data held on them, but since they cannot access that data in the first place, it is unclear how they can know if it is accurate or inaccurate in order to rectify it.
Amendment 74, in my name and that of my noble friend Lady Hamwee, gives the Minister the opportunity to put on record “something that I understand”, as she said in a Peers’ briefing session during recess which sadly I was unable to attend. She said that the code given to a landlord or employer to check immigration status would not allow them to check, for instance, health information, or to use the information they obtained for any other purpose. I hope that the Minister will therefore be able to accept this amendment, which encapsulates something that she has told Peers.
Amendment 72, in the name of the noble Baroness, Lady Bennett, seeks to limit the use for immigration purposes of data gathered by certain public service bodies in healthcare and education, and where the person has reported a crime or being a victim or witness to a crime. The amendment is helpful in at least limiting the harmful impact of Paragraph 4 of Schedule 2 to the Data Protection Act, but that paragraph in fact needs wholesale deletion. I beg to move.
My Lords, my Amendment 72 complements my Amendment 71. I have spoken at length on these issues, so I will be brief. I also support Amendments 43 and 74, in the names of the noble Baronesses, Lady Hamwee and Lady Ludford. I thank the noble Lord, Lord Paddick, and the noble Baroness, Lady Hamwee, for making the same point as I made at the start of my speech. It might seem somewhat disingenuous to suggest that these amendments are discriminatory by choice, when we were actually given the option of applying these only to limited numbers of people. Everyone who has spoken on this subject has expressed their desire to see them used to end the entire hostile environment.
My Lords, the Data Protection Act is designed to fundamentally affect the way we use data to market, provide services and run our businesses. It also provides an obligation to warn people how their data will be gathered and used. My noble friend has already spoken about why the immigration exemption in the Data Protection Act 2018 does not apply to EEA or Swiss nationals. I support the arguments that have been advanced, particularly in the field of immigration.
Immigration is a fairly emotive issue and the use of data has caused serious problems in this country. There is an insatiable appetite to question migrants about their movements, but to put very little emphasis on what has been said. The Minister arranged a briefing session prior to Committee. I was not satisfied when I asked why some of the agencies can share the information collected but the police have been excluded from this arrangement. We need clarity on this issue, and I hope that the Minister will be able to provide that today.
I do not dispute the procedures, which are to admit those who are eligible and to remove those who are not, but in any administrative system questions arise about priorities. The administration of the immigration system is no exception and we know that the points system is to be introduced at the tail end of this particular withdrawal Bill. The purpose of the data collection is not in dispute. The administration of the immigration system about the need to exclude the ineligible is no exception. It has always been the case that to exclude the ineligible means that checks have to be made to determine who is eligible and who is not. The immigration officers have similar powers to those of the police in this matter. There is always a concern about fishing raids unless they are done on intelligence. The problem is that the more intensive these checks are, the more delay and expense there is to those who are eligible. The matter of proper documentation has been a point of dispute and likely to cause serious problems. We have seen this in relation to Windrush, which is so often mentioned in debates on this subject. Even today, after 70 years, we have not resolved this issue. We may head towards the EU settled migrants with similar problems if we fail to give proper documentation backed up by proper data collection and the proper use of information collected.
There are ample safeguards on how the information on individuals is to be used. It is explicit that such information may not be used for immigration control or enforcement. All we want to ensure is that there is less adversarial contact with migrants. The police need adequate information in their duties as providers of public services, as is the case with public service organisations such as the NHS and schools.
My Lords, I want to address my remarks to Amendments 43 and 74 in the names of my noble friends. As my noble friend Lady Ludford has so eloquently outlined, the exemption from data protection for migrants is unjustifiable. Indeed, as she said, the suggestion that we might even withdraw from the European Convention on Human Rights only adds to the alarm that we should feel about that.
This issue goes back some way, as my noble friend Lady Ludford said. During the passage of the Data Protection Bill through Parliament, my noble friend Lady Hamwee raised this issue and sought to amend the Bill, sadly unsuccessfully at that time. She asked the Government to justify the exemption, but from my reading of Hansard, they either could not or would not. She also asked for reassurance from the Minister —and I believe it was the same Minister, the noble Baroness—but, sadly, she did not seem to get much. In fact, the Minister told the House that a decision on whether to apply the exemption could be exercised not only by the Home Office but by contractors who worked for the Home Office. She said that it would apply not only to migrants but to British citizens who supported the applications of migrants. The one piece of assurance that the Minister gave was that the exemption would be used in only a very small number of cases. She was quite explicit about that, so I hope that in her reply, the Minister will tell us how many times the exemption has been applied and, if not, whether she will undertake to write to us.
The truth is that the exemption gives huge discretion to the Home Office and its contractors to determine when access to data can be denied. The Government say that it would not be abused. That might be fine if we had not had the events of Windrush, which my noble friend Lord Dholakia referred to, and if we really felt that we could trust the Home Office and its contractors in this era of the hostile environment. However, in these circumstances it is very hard to do so. We have no way of knowing how the exemption is being applied, unless the Minister is able to tell us a bit more about that. Therefore, this is a matter of significant concern to us. As my noble friends have noted, we are seeking to remove the exemption from EEA nationals. I hope that we will not hear from the Minister that that is in some way discriminatory, as we want it removed from everybody.
Finally, and briefly, on Amendment 74, as my noble friend Lady Ludford said, we really want to hear an assurance from the Minister on this matter that will appear in Hansard.
As we know, the Data Protection Act 2018 provides for an exemption from some general data protection provisions where personal data is processed for the maintenance of effective immigration control. Of course, that allows an entity that processes data for immigration control purposes, such as the Home Office, to set aside a person’s data protection rights in a range of circumstances. It can also prevent people involved in immigration cases being able to request access to the data that the Home Office holds on them, and that could affect EEA or Swiss nationals applying for a new immigration status in the UK after Brexit.
As has been said, Amendment 43 would preclude the exemption from applying where the person in question is an EEA or Swiss national. EEA and Swiss nationals will become subject to this exemption as a result of our departure from the EU.
Amendment 72 would ensure that personal data belonging to an EEA or Swiss national resident in the UK before the Act that has been gathered through their use of public services cannot then be shared and used for the purposes of immigration enforcement. The relevant public services include primary and secondary education, and primary and secondary healthcare services, as well as where a person has contacted law enforcement to report a crime.
Amendment 74 would provide that a third party—for example, a landlord—given access to check a person’s settled status for specific purposes may not be allowed to use that access or information for any other purposes.
The issue is that there have been reports and evidence of data sharing as part of the Government’s rebranded hostile environment controls when people have, for example, access to education or report a crime to the police. In that latter regard, there appear to be examples of migrant women in particular suffering domestic abuse and being deterred from reporting a crime for fear of getting pulled into the immigration system. The comment has already been made about the independent Windrush Lessons Learned Review identifying a number of people from the Windrush generation who have been wrongly subject to proactive compliant environment sanctions, where the Home Office has shared data with other departments. Therefore, there is a lot of evidence that this data sharing goes on and that it has a detrimental effect on some individuals.
The Independent Chief Inspector of Borders and Immigration has found a 10% error rate in immigration status checks. Therefore, being unable to find out what immigration data the Home Office holds that led to an error—for the purposes of an appeal, for example—is of significance. The figure that I have been given—I am sure the Minister will correct me if I am wrong—is that, since the beginning of 2019, 60% of requests for disclosure have been denied. I hope that in their response the Government will, at the very least, say how they intend to address the concerns raised by this group of amendments.
I thank noble Lords for the points that they have made on these amendments. Perhaps I may address Amendments 43 and 72 together, as they both concern data protection.
I appreciate the concerns to protect data subjects’ rights and to ensure that data sharing for immigration control or enforcement purposes does not prevent people living in this country accessing public services to which they are perfectly entitled. However, I cannot agree to these new clauses, because they would not be proportionate or constructive amendments to the Bill, or indeed address the concerns behind the amendments, and I shall say why.
They would restrict immigration authorities in performing their lawful duties in respect of immigration control, including being able to confirm a person’s immigration status, and they would be unable to prevent potential prejudice to the immigration system. Essentially, the new clauses would expressly prohibit the Home Office from using a necessary and lawful exemption in the Data Protection Act 2018, should it have cause to do so. The immigration exemption has been debated previously in this House and concerns raised have been addressed on those occasions.
The exemption applies to restrict specified data subjects’ rights where the maintenance of effective immigration control, or the investigation or detection of activities that would undermine the maintenance of effective immigration control, are likely to be prejudiced. Rightly, it should apply to anyone who is subject to immigration control, including EEA and Swiss citizens. The new clause proposed in Amendment 43 would therefore constitute a difference in treatment on the grounds of nationality. We do not believe that that can be justified, as one purpose of the Bill is to ensure that there will be no difference in treatment between EEA citizens and those from the rest of the world when it comes to immigration policy.
Amendment 72 would have a similar effect in creating a difference in treatment based on nationality. The effect of the amendment in the clause would be to maintain the current position, so that one particular aspect of the compliant environment—data sharing—would not apply to those who now benefit from free movement. The amendment would have no effect as far as non-EEA citizens are concerned, and data collected in relation to them could still be used for immigration control or enforcement purposes, thereby treating them unequally under the law.
With regard to the immigration exemption dealt with in Amendment 43, it might help if I expand on the safeguards built into the Data Protection Act. The exemption can be applied only on a case-by-case basis and only where it is necessary and proportionate to do so. It cannot be, and is not, used to target any group of people, be they EEA citizens or otherwise. Nor does the application of the exemption set aside all data subjects’ rights; it sets aside only those listed in paragraph 4 of Schedule 2. A further limitation is that the exemption can be applied only where compliance with the relevant rights will be likely to prejudice the maintenance of effective immigration control. This “prejudice” test must be applied first, and, as a result, the situations in which the exemption can be used are significantly limited. The noble Lord, Lord Oates, asked me to give numbers. I cannot do so at this point, but I will see whether I can access them.
Furthermore, the exemption may be applied only so long as the prejudice can be seen to be evidenced and must be removed thereafter. It is not used to restrict access to personal data that would allow a person to further a claim; it is used only where we need to restrict access to sensitive data—for example, details of ongoing enforcement operations.
The exemption has been found to be lawful by the courts, and the ICO has issued robust guidance on how and when it may be used—guidance that the Home Office adheres to. Furthermore, the Home Office has robust safeguards and controls in place to ensure that data is handled securely, lawfully, ethically and in accordance with all relevant data protection regulations. I say again that the Home Office must at all times comply with the GDPR and the Data Protection Act 2018 when data is shared.
Similar to Amendment 72, Amendment 74 seeks to limit the use of data. To reiterate the points that I made to noble Lords during the recess, I reassure them that the services that we provide to third parties for checking immigration status information about EU settlement status can be accessed and used only to check an individual’s immigration status and the rights associated with that status.
I will explain how users can view and prove their immigration status under the EU settlement scheme. Individuals can authenticate securely on the “view and prove your settled or pre-settled status” online service, where they can view their immigration status information and choose to share it with third parties for a variety of reasons. To take the example of right-to-work checks, the individual selects the option to share their right-to-work information and is given a time-limited code, which can be emailed or given to the employer. The employer uses the share code, along with the individual’s date of birth, to access just the information needed to confirm the individual’s eligibility to work, via the “view a job applicant’s right to work details” service on GOV.UK. The information provided to the employer can be previewed by the individual and contains only information relating to their right-to-work entitlements, along with the individual’s name and facial image for verification purposes and the expiry date of the leave, where appropriate. I hope that the noble Baroness, Lady Ludford, who asked me to reiterate this point, is satisfied with my explanation.
For other services such as health, benefits and banking, users can share basic information about their status under the settlement scheme and the process works in exactly the same way. Checking organisations can access the information on a time-limited basis, via the “check someone’s settled or pre-settled status” service. The information provided in this service represents the minimum amount of data required for those checking organisations to perform their duties, and again includes the individual’s name, facial image, the leave they have been granted and the expiry date where applicable.
Third parties do not have access to the immigration database. An individual must choose to share their immigration status through the “view and prove” service before it can be viewed by third parties such as employers. Picking up on the point made by the noble Lord, Lord Dholakia, the police do not have access to the EU settlement scheme or the immigration database, but we are working with other parts of government to develop system checks to share immigration status for specific purposes such as health and benefits. For example, we will provide information to the National Health Service to support it in establishing whether an individual is entitled to access free healthcare.
I hope that noble Lords are now assured that we are committed to delivering immigration status services for the purposes of checking immigration status information only. These services have been designed to protect the personal information of those with EU settled status and have been built around GDPR principles, including that of data minimisation, ensuring that the information available to third parties is only what is absolutely necessary. I hope that, with those words, the noble Baroness is happy to withdraw her amendment.
My Lords, I thank the Minister for her answers but the first is, again, the disingenuous objection that the amendment focuses only on Swiss nationals and is therefore discriminatory on the grounds of nationality. I repeat something that my noble friend Lady Hamwee has said at least twice: it is up to the Government to extend it to all migrants if they wish.
Can the Minister tell us—she may have to write to me—whether any other EEA countries have exempted immigration data in their implementation of the general data protection regulation? Also, she said that the Data Protection Act was compliant with GDPR, but that remains to be seen. I think it is doubtful because that regulation, which I worked on as an MEP, provides no blanket exclusion of immigration data. The Minister did not respond on the prospect of a data adequacy decision from the European Commission. Winning this decision is of huge significance to our security and our businesses.
The combination of this part of the Data Protection Act, not retaining the charter and constant noises about the European convention is not designed to increase the confidence of the European Commission in granting a data adequacy decision. Not getting that will seriously prejudices the chances of the cross-border police co-operation that is vital to this country. The UK has made a huge contribution in that area in building up the EU justice and security measures, as was shown when Theresa May was Home Secretary about six years ago and we had the mass opt back in to all the vital measures. If we are unable to continue that, we will not be able to access information required to catch serious criminals and it will prejudice the security of British citizens. Also, if we do not get a data adequacy decision, it will be much more difficult for businesses to transfer data across the EEA—tech businesses are particularly reliant on data—using other, clunkier routes.
Already, a shadow has been cast on the ability to get a data adequacy assessment by the surveillance provisions in the Investigatory Powers Act and others; that has been the subject of several court cases in Luxembourg and Strasbourg. It is dangerous to undermine further the chances of a data adequacy decision. There are higher things than the Home Office’s wish to have constant access to this data.
Hope springs eternal. I thank the Minister for what she said on Amendment 74, which I will read carefully in Hansard. Unfortunately, she is not giving me any comfort on the other amendments, including Amendment 43, which I moved. However, at this stage, I beg leave to withdraw the amendment.
Amendment 43 withdrawn.