The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations amend the immigration exemption in paragraph 4 of Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case of R (on the application of Open Rights Group and another) v Secretary of State for the Home Department and another (Liberty and another intervening) ([2021] EWCA Civ 800).

The immigration exemption allows certain specific rights and obligations in the UK GDPR to be restricted to the extent that giving effect to those rights and obligations would be likely to prejudice:

(a) the maintenance of effective immigration control, or

(b) the investigation or detection of activities which would undermine the maintenance of effective immigration control.

It is only the provisions of the UK GDPR listed in paragraph 4(2) of Schedule 2 to the 2018 Act which are affected by the immigration exemption.

The immigration exemption is amended to make clear that it may be relied on only by the Secretary of State and only if the Secretary of State has in place an immigration exemption policy document. An “immigration exemption policy document” is a document which explains the Secretary of State’s polices and processes for determining whether, and the extent to which, the immigration exemption applies in any particular case, and for ensuring that any personal data covered by the exemption is not abused or accessed or transferred in a manner contrary to the UK GDPR.

Additional safeguards are also added to the exemption to require the Secretary of State:

(a) to decide whether the immigration exemption applies on a case by case basis, and to have regard to the immigration exemption policy document when making such decisions;

(b) to keep a record of any decision that the immigration exemption applies and the reasons for that decision;

(c) to inform a data subject of any such decision, unless doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b) of Schedule 2 to the 2018 Act.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.