I said that if another judicial review is forthcoming, it will be a matter for those who bring it forward. I said to the noble Baroness, Lady Hamwee, that I do not have details of that but will provide them if I can. However, by developing the immigration exemption policy document, we have sought to make it easier to change our policy to address future concerns and to be seen as being as open and transparent as we can be.
6.45 pm
The only other major change is to make the immigration exemption available only for the use of the Secretary of State. This was due to arguments about so-called rogue landlords, who could use it to deny immigrants’ rights. We have always maintained that only a person with intimate knowledge of the immigration system would be able to lawfully justify the prejudice that is built into the immigration exemption, and we think that this change puts those arguments and concerns to rest. We have also added a requirement to inform a data subject where the immigration exemption has been applied, except where to do so would be prejudicial to the purpose of the immigration exemption
itself. That is, to go back to it, the maintenance of effective immigration control or the investigation or detection of activities that would undermine the maintenance of immigration control.
I think it was the noble Baroness, Lady Hamwee, who asked: “How can people challenge what you have on them if they don’t know what you hold?” I would say to that that we redact only small parts of documents that contain sensitive data that could affect operations. The information we redact therefore mainly relates to operational matters. The immigration exemption is used only on a case-by-case basis, when necessary and proportionate, and is subject to the safeguards set out in the instrument.
On the number of cases, we have to be able to show that it is necessary to use the immigration exemption when relying on it. Even when it is deployed, it is used in a proportionate and necessary way, and only the minimum amount of data is ever redacted. On solicitors, the exemption is not used to prevent a person establishing a legal claim, and that is stated in the immigration policy document.
On individuals not knowing what the Home Office holds on them and how they can rectify any errors, the immigration exemption can be used only to the extent that releasing information would be likely to prejudice the maintenance of effective immigration control, as I said. It is likely to be applicable only to a limited amount of information—for example, information specifically relating to attempts to locate an individual, such as an absconder, could be withheld—if the prejudice test is met, and an individual making a subject access request would still receive the rest of the personal data that did not satisfy the prejudice test. Individuals can also request rectification of their data. The immigration exemption does not restrict the right to seek rectification of inaccurate data, and anyone who seeks the Home Office’s help—for example, to prove residency—will not ordinarily be restricted by the immigration exemption.
On safeguards in the statutory instrument, the court did not specify which limbs of Article 23(2) we need to address, and expressly envisaged the possibility that some might not be relevant. The Secretary of State considers that the legislative measure wholly addresses the reasons for incompatibility referred to in the judgment in the Court of Appeal. We think that the immigration exemption is fully compliant with restrictions allowed in the UK GDPR, and Article 23(2) of the UK GDPR states that any legislative measure restricting obligations and data rights must contain specific provisions, where relevant. We have determined that some limbs of Article 23(2) are already sufficiently covered in the Act, and that one is not relevant; therefore, no amendments will be made to legislation in relation to that limb. The immigration exemption policy document is a guidance document; it is open to the public and, if necessary, to court scrutiny.
The noble Lord, Lord Paddick, asked about the safeguards in the SI. They include restricting the application of the exemption to where the department itself is the controller, and the requirement to inform where the data subject has applied for data about them, save in circumstances which I think I have gone through.