Citation, commencement and extent

1.—(1) These Regulations may be cited as the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.

(2) These Regulations come into force on—

(a) 8th March 2024, or

(b) if later, the day after the day on which they are made.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

Amendment of paragraph 4 of Schedule 2 to the Data Protection Act 2018

2.—(1) Paragraph 4 of Schedule 2 to the Data Protection Act 2018( 4) (immigration) is amended as follows.

(2) In sub-paragraph (1), for “UK GDPR provisions listed in sub-paragraph (2)” substitute “relevant UK GDPR provisions”.

(3) Omit sub-paragraphs (1A) and (1B).

(4) In sub-paragraph (1C)—

(a) omit “additional”;

(b) for “this paragraph” substitute “sub-paragraph (1)”.

(5) In sub-paragraph (2), for “The UK GDPR provisions referred to in sub-paragraphs (1) and (1B)” substitute “In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions””.

Substitution of new paragraphs 4A and 4B of Schedule 2 to the Data Protection Act 2018

3.  For paragraphs 4A and 4B( 5) of Schedule 2 to the Data Protection Act 2018, and the italic headings above those paragraphs, substitute—

“Immigration: safeguards: immigration exemption decisions

4A.— (1)  A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “ an immigration exemption decision ”) must be made in accordance with this paragraph.

(2)  An immigration exemption decision must be made—

(a) on a case by case basis,

(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

(3)  When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

(a) any potential vulnerability of the data subject that is relevant to the decision,

(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

(c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—

(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009( 6) (duty regarding the welfare of children), and

(iii) the need to ensure compliance with the UK GDPR.

(4)  A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

(5)  In this paragraph—

“ Convention rights ” has the same meaning as in the Human Rights Act 1998( 7) (see section 1(1) of that Act);

“ the Refugee Convention ” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol( 8) ;

“ the Trafficking Convention ” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005( 9) .

Immigration: safeguard: record of decision that exemption applies

4B.— (1)  Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.

(2)  Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b). ”.

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations amend the immigration exemption in Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12)(“ the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case ofR. (on the application of the 3million and Open Rights Group) v. Secretary of State for the Home Department and Secretary of State for Science, Innovation and Technology (formerly Secretary of State for Digital, Culture, Media and Sport), and The Information Commissioner as an Interested Party ([2023] EWCA Civ 1474).

The immigration exemption allows certain specific rights and obligations in the UK GDPR to be restricted to the extent that giving effect to those rights and obligations would be likely to prejudice: (a) the maintenance of effective immigration control, or (b) the investigation or detection of activities which would undermine the maintenance of effective immigration control.

The immigration exemption was amended by S.I. 2022/76to add safeguards to the exemption.

These Regulations further amend the immigration exemption to amend the safeguards and ensure that safeguards relating to decision-making are set out on the face of the legislation.

Regulation 2 amends paragraph 4 of Schedule 2 to the 2018 Act so that it provides only for the exemption itself and the provisions of the UK GDPR to which the immigration exemption can apply (“relevant UK GDPR provisions”). It revokes the provisions relating to the immigration exemption policy document and its role in decision-making.

Regulation 3 substitutes new paragraphs 4A and 4B into Schedule 2 to the 2018 Act. Paragraph 4A sets out safeguards relating to decision-making. Paragraph 4A:

Paragraph 4B(1) provides that the Secretary of State must keep a record of any decision that the immigration exemption applies and the reasons for that decision. Paragraph 4B(2) provides a rebuttable presumption that the data subject be informed of the use of the immigration exemption.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.