“The Secretary of State shall, on the day on which this Act is passed, publish the memorandum of understanding between the Department for Work and Pensions and the Home Office regarding automated residency checks for the purposes of the EU Settlement Scheme.”—

This new clause would mean the memorandum of understanding between the DWP and the Home Office regarding the automated residency checks for the EU Settlement Scheme is published.

Brought up, and read the First time.

I beg to move, That the clause be read a Second time.

With this it will be convenient to discuss the following:

New clause 25—Data categories for the automated residency check for the EU Settlement Scheme—

“The Secretary of State shall, on the day on which this Act is passed, publish which categories of data are provided by the Department for Work and Pensions to the Home Office for the purpose of the automated residency checks for the EU Settlement Scheme.”

This new clause would require the Home Office to publish information on which categories of data are provided by the DWP to the Home Office for the purpose of the automated residency checks for the EU Settlement Scheme.

New clause 26—Process applied by the Home Office during the automated residency check for the EU Settlement Scheme—

“(1) In relation to the automated residency check for the EU Settlement Scheme, the Secretary of State shall, on the day on which this Act is passed, publish the details of the process, which is used in order to—

(a) convert the data provided by Her Majesty’s Revenue and Customs to a record of residency;

(b) ascertain whether the record of residency created using the data provided by Her Majesty’s Revenue and Customs meets the criteria for settled status;

(c) convert the data provided by the Department for Work and Pensions to a record of residency;

(d) ascertain whether the record of residency created using the data provided by the Department for Work and Pensions meets the criteria for settled status;

(e) combine the record of residency created using the data provided by the Her Majesty’s Revenue and Customs with the record of residency created using the data provided by the Department for Work and Pensions; and

(f) ascertain whether the combined record of residency created by the process set out in subsection (e) meets the criteria for settled status.

(2) The Secretary of State shall publish any change to the process set out in subsection (1) within a period of seven days after such a change is implemented.”

This new clause would mean that the process applied by the Home Office during the automated residency check, any changes made to that process, and information regarding that process, would be published.

New clause 27—Data protection impact assessment relating to the automated residency check for the EU Settlement Scheme—

“The Secretary of State shall, on the day on which this Act is passed, publish a data protection impact assessment relating to the automated residency checks for the purposes of the EU Settlement Scheme.”

This new clause would mean that the Secretary of State had to publish a data protection impact assessment relating to the automated residency checks within the EU Settlement Scheme application process.

New clause 28—Information to applicants on the outcome of the automated residency check—

“At the same time as an applicant to the EU Settlement Scheme receives a wholly or partially unsuccessful result from the automated residency check, the Secretary of State must provide the applicant with—

(a) the periods of time during which the Secretary of State accepts that the applicant was resident;

(b) the periods of time during which the data do not evidence residence;

(c) the data processed by the automated residency check;

(d) information on the process that was applied to the data in paragraph (c) to produce the periods of time as set out in paragraphs (a) and (b).”

This new clause would mean information was given immediately to an applicant who was informed that the automated residency check result for the EU Settlement Scheme was not successful.

New clause 29—Legal limits on the use of personal data processed during the EU Settlement Scheme—

“(1) The Secretary of State may not further process personal data that has been processed during the EU Settlement Scheme application procedure unless—

(a) the data subject has given consent to the processing of his or her personal data for such further processing, or

(b) such further processing is limited to what is necessary in relation to the purposes for which the data are processed, and not further processed in a manner incompatible with the purposes of applying for settled or pre-settled status.

(2) Transferring the personal data to immigration enforcement or to a database accessible by immigration enforcement, does not satisfy subsection (1)(b).

(3) Paragraph 4 of Schedule 2 of the Data Protection Act 2018 does not apply to further processing referred to in subsection (1).”

This new clause would mean that the data of EU nationals who apply through the EU Settlement Scheme are not passed to immigration enforcement or to a database which may be accessed by immigration enforcement.

New clause 31—Requirement to check manually for system errors when an applicant does not pass the automated residency check—

“At the same time as an applicant through the EU Settlement Scheme application process receives a wholly or partially unsuccessful result from the automated residency check, the Secretary of State must manually check for errors in the automated data checks, including but not limited to—

(a) data matching errors;

(b) errors in creation of the record of residency from the data;

(c) errors in adding data to a record of residency to create a new record of residency

(d) errors resulting from using the process applied during the automated residency checks on a record of residency to create an output.”

This new clause would mean that a manual check for errors is made when an applicant does not pass the automated residency check before they are required to provide documentation to prove their residency for the purposes of settled status.

Let me say at the outset that I am stepping somewhat outside my comfort zone in discussing automated data checks, so I am grateful for the assistance provided by the Immigration Law Practitioners Association and the Open Rights Group.

The settled status scheme relies heavily on automatic data checks. Input of a national insurance number triggers the automatic transfer of certain data from HMRC and the DWP to the Home Office. That data is subjected to algorithmic machine analysis according to a Home Office business logic, details of which have not been made public. Result outputs of pass, partial pass and fail are issued to a Home Office caseworker. Once the output is received, the raw data apparently disappears. Applicants who pass the data check are deemed to have fulfilled the residence requirement for the purposes of settled status. Applicants who do not pass are invited by caseworkers to upload documents for manual checking. Applicants who cannot evidence five years’ continuous residence generally receive pre-settled status.

Campaign organisations, including ILPA and the Open Rights Group, rightly believe that the Home Office has three specific legal duties—to give reasons for data check outcomes, to ensure that its caseworkers have meaningful oversight of the checks, and to provide public information about the scheme. The new clauses identify actions that the Home Office should take to comply with those three duties. They seek more information about the data checks and they would increase transparency.

Let me briefly take each of the three duties in turn. The first is the duty to give reasons for the outcome of a data check. The Home Office is under a common law duty to give reasons for its decisions to grant or refuse settled status. The data checks are a mandatory step in the scheme and they are integral to decision making. The duty to give reasons therefore includes a duty to explain why the data checks gave the result they did. Reasons should detail what data was analysed and how the business logic was applied. That information would enable applicants to appreciate whether decisions were open to challenge for irrationality or were made on the basis of inaccurate information.

If the Home Office accepts that it has a duty to give reasons, at least in some cases, how will it approach the need to retain records to supply such reasons? What data about applicants is retained by the Home Office as a result of the data checks? For what reason, and for how long, is that data retained? Which persons does the Home Office envisage will have a genuine business need to see that data?

The second duty is the duty to inform the public about the logic of the data checks. The EU General Data Protection Regulation of 2018 requires the Home Office to process data in a transparent manner. It would be consistent with such duties of transparency and openness if the Home Office provided meaningful public information about its business logic that enabled applicants to understand how it will apply in their case. Will the Home Office provide full details of, or sufficient information about, its business logic to allow its application to all types of individuals to be understood and to allow for independent review? What steps is the Home Office taking to limit and rectify business logic operational errors?

The third duty is the duty to exercise supervisory control over data checks. Making decisions by relying on output from automated data checks without scrutinising these is likely to constitute unlawful delegation of powers. To prevent this, a manual check for system errors should be conducted when applicants challenge refusal of settled status.

Proper oversight, safeguards and transparency are essential when dealing with complex decisions and people in vulnerable situations. It is important for EU nationals to know whether they are eligible for settled status, and if they are not eligible, the future date on which they are likely to become eligible. At the outcome of the data check, the Home Office should inform non-passing applicants which years the checks accepted covered, and which not. This would also improve system efficiency by reducing unnecessary challenges.

Some final questions: on the basis that residence is not contingent on income or contribution, why does it appear that different weighting is applied to data from the Department for Work and Pensions and from HMRC? Why is HMRC requested to provide data first, and not DWP? Will the Home Office add functionality in the scheme to enable applicants to easily request and obtain the information that HMRC and/or DWP have supplied about them? What steps is the Home Office taking to address the particular challenges faced by vulnerable groups such as children in care, persons in abusive or coercive relationships, victims of labour exploitation and trafficking and people who cannot provide documentary evidence, notably children, pensioners, non-working dependants, homeless persons, casual workers and victims of domestic abuse?

We support these amendments. I make two brief comments. First, the EU settlement scheme will entail an enormous amount of data sharing between the Home Office and other Departments. It is right that the terms of this data sharing should be transparent. Secondly, the possibility of EU citizens’ data being passed on by the Home Office has understandably caused concern among those citizens. We do not want to create any barriers to EU citizens applying for settled status. Getting a high take-up rate is already going to be extremely difficult. Providing for explicit consent for data to be shared or reused would be a sensible limit on Government powers.

I am grateful to the hon. Members for their new clauses 24 to 29 and 31. Given the similar effects of some of these new clauses, I will consider new clauses 24 to 28 and 31 together before speaking to new clause 29 separately.

These clauses cover a broad range of issues, including the gathering and using of data and matters relating to the automated residency checks under the EU settlement scheme. As I have said previously, securing the rights of citizens has always been our priority and we have delivered on this commitment. The draft withdrawal agreement published on 14 November 2018 guarantees the rights of EU citizens and their family members living in the UK, and those of UK nationals living in the EU.

The basis of the withdrawal agreement aligns closely to that of existing free movement rules with respect to when a person becomes a permanent resident and, in the case of the EU settlement scheme, acquires settled status. Significantly, the withdrawal agreement states that this assessment should be based not only on length of residence but on the fact that a person is exercising EU treaty rights for the whole qualifying period. We have, however, gone further than this and are being more generous to all EU citizens in the UK and to those who arrived during the implementation period. We do not test whether a person is exercising treaty rights—for example whether they are in work, studying or have comprehensive sickness insurance. Eligibility is based on residence alone, subject to criminality and security checks.

As part of the application process we will, where an applicant provides a national insurance number, conduct an automated check of residence based on tax and certain benefit records from HMRC and the DWP. We know that most EU citizens will have had some interaction with these departments and that this could demonstrate an applicant’s residence, either for the whole five-year period to qualify for settlement, or in part. While it is optional for an applicant to use the automated checks to prove their period of residency, in the test phases most have done so.

To date, 80% of the decisions made have been on the basis of this data alone. Where data exists, the automated checks replace the need for the applicant to submit any other form of evidence. The automated checks happen in real time as the application is completed, and the applicant is informed whether there is enough data to qualify for either settled or pre-settled status. Feedback from the three trial phases to date shows that people overwhelmingly like the simplicity of having their residence proved for them by these checks. The applicant is immediately informed if they need to provide additional documents and prompted to provide such documentation before completing their application.

In such instances, we will accept a range of documents as evidence, and they can be submitted digitally as part of the online application process. Where the applicant accepts the result of the automated check, no further evidence is required, and they will, subject to identity, security and criminality checks, be granted either settled or pre-settled status. The rules for assessing continuous residence are already set out in the immigration rules. The automated checks simply apply those principles to the data provided by HMRC and the DWP. New clauses 26 and 28, although well intentioned, are therefore unnecessary.

I understand the sentiment behind new clauses 24, 25 and 27, on publishing details of the automated residency checks in the scheme, as well as our memorandum of understanding with HMRC and the DWP. We will of course be completely transparent on how those checks work, as it is to everyone’s benefit for us to do so. I confirm that we will publish the MOU before the scheme is fully launched. We will also publish further materials, including more guidance on why automated checks may not return the expected data. The EU settlement scheme is still in the test phase, and it is important that we continue to amend our processes and design as we progress through the phased roll-out. I hope that offers reassurance to hon. Members.

On new clause 31, it may be helpful if I explain the different stages of the application process. When an applicant receives a wholly or partially unsuccessful result from the automated residency check, they are still in the middle of the application process and they have completed only some of the online form. They have therefore not yet submitted an application. Informing an applicant of why data has not matched is likely to increase the risk of fraud and identity abuse. The new clause would change the focus of the scheme from granting status to investigating the data quality of employers or of the DWP and HMRC. We consider that a distraction that would cause unnecessary delays for applicants.

I am sure all hon. Members on this Committee share my desire to keep the application process simple and quick in providing results. For the reasons I have given, the new clause is not consistent with those aims. In most cases, it would be far simpler and more straightforward for applicants to submit other evidence to prove residence, rather than seeking to resolve why data has not matched. Of course, the applicant can take up that issue with HMRC or the DWP if they wish. It is already the case that applicants, like anyone else, can ask Government Departments what data is held about them and get incorrect information rectified, as per article 16 of the general data protection regulation.

Our guidance includes a suggested list of documents that could be provided as additional evidence. Examples include bank statements, a letter from a general practitioner, and certificates from school, college, university or an accredited educational or training organisation. I assure hon. Members that we will continue to work to improve the match rates of the automated checks. The test phase gives us the opportunity to test the EU settlement scheme and to make improvements to the process.

New clause 29 seeks to prevent information from those who apply to the EU settlement scheme from being passed to immigration enforcement. Let me confirm that we fully comply with all statutory responsibilities when processing data. The ways in which this information may be processed are set out in the Home Office’s “Borders, immigration and citizenship: privacy information notice”, which is available on gov.uk. Decisions on whether information should be shared with immigration enforcement are made on a case-by-case basis. It is important that the Home Office uses data in ways that are compatible with the purpose for which it is collected—for example, to assist future citizenship and passport applications and, if needs be, to combat immigration offences.

To conclude, I thank hon. Members for raising these important issues, but I hope the assurances I have provided will lead them not to press their new clauses.

I am grateful to the Minister for her detailed answers, and particularly the undertaking to publish the MOU. I obviously need to take all that away and give it further thought, but there seemed to be a lot of helpful answers and pointers in there, so in the meantime, I beg to ask leave to withdraw the clause.

Clause, by leave, withdrawn.