We are thrilled to announce that in December 2023, the Court of Appeal found that the Immigration Exemption in the Data Protection Act 2018 is unlawful.  

We have been fighting this battle since 2018 - and now, six judges have found in our favour. We could never have protected migrants’ data rights without you. Thank you to all of you for supporting us and donating so generously - without you, the3million and Open Rights Group wouldn’t have been able to pursue this important legal case. 

The Home Office uses the exemption to deny migrants access to their own data in 66% of cases. The government has been told it needs to set out safeguards in legislation, thus facing Parliamentary scrutiny.

The government stated in the legal case that the immigration exemption would be used to profile all migrants’ data (including on travel), to work out if people might be abusing their rights or might be undertaking a “sham” marriage. 

It’s shameful how this government is fighting tooth and nail to deny migrants our fundamental data rights, sidestepping parliamentary scrutiny. We suspect the Home Office use the Exemption especially to justify data transfers abroad, large scale processing and profiling exercises. 

We’ve fought this battle since 2018. We didn’t give up, we persevered and today we’ve won. Together with Open Rights Group, represented by Leigh Day, and supported by an intervention from the Information Commissioner, this is a victory for all migrants.

And we couldn’t have done it without you. Together, we protected our rights and refused to allow the government to brush this under the rug. 

This legal challenge has been made possible by people like you. Funds pledged through CrowdJustice enabled our small team to persevere over the years. These funds protected us, in the event we lost the case and had to cover the government’s legal fees.

Thank you again for standing with us along the way. We have further to go towards building a fair and transparent immigration system, but today's judgment demonstrates our people power and brings us a step closer.

In solidarity,

The teams at the3million and Open Rights Group

A reminder of what the Immigration Exemption case is about

The Immigration Exemption affects the data protection rights of anyone who has had any contact with the Home Office.

The Data Protection Act 2018 gives people the right to greater control over their own data. People should be able to find out what data is held on them, through Subject Access Requests (SARs). 

This right is often called a ‘gateway right’, because knowing what data is held enables a person to exercise their other Data Protection rights, including the right not to be subject to a decision based solely on automated processing, including profiling. 

Other rights include the right to have their data corrected, deleted and to object to processing of their data. 

Although most of these rights come with some limits built into them anyway, the Immigration Exemption was created to restrict these rights even further when the Home Secretary considers such rights would get in the way of “effective immigration control”.

The Home Office is allowed to create exemptions to data protection rights, but there must be safeguards to prevent abuse of the exemption, and a provision on the risks to the rights and freedom of data subjects. These safeguards and provisions must be set out in legislation. 

The Immigration Exemption legal challenge has been fought on the basis that there are insufficient safeguards or considerations of the risk involved, and that in any case, these have not been set out on the face of the legislation.

Instead, the Home Office has merely stated in the legislation that there must be a policy document containing relevant safeguards. Such a policy document is not part of the legislation - and as such it can be changed by ministers at a moment’s notice, and without any parliamentary scrutiny whatsoever.

Yesterday, 11 December 2023, the judgment of the three Court of Appeal judges is unequivocal, stating that the Immigration Exemption is incompatible with the Data Protection Act 2018: 

“In essence, what the Secretary of State is saying to Parliament is that there will be additional safeguards but is not willing to tell Parliament what they are. They will be set out in another document, which the Secretary of State can change at will.”

The Court of Appeal has given the Government three months to fix its legislation. 

See here for the full judgment: https://www.judiciary.uk/judgments/the-3million-v-secretary-of-state-for-the-home-department/