Dear backer and supporter of the cause,

We have been granted permission to proceed to a full hearing by the High Court in relation to a second legal challenge of the Immigration Exemption.

The "immigration exemption", in the Data Protection Act 2018, was ruled unlawful by the Court of Appeal in June 2021 following a challenge brought by Open Rights Group and the3million.

The exemption, in Schedule 2 of the Data Protection Act, has been used by theHome Office and private companies working to control immigration to refuse requests by individuals for access to personal data held about them on thegrounds that it might "prejudice the maintenance of effective immigration control". Precisely how widespread the usage of the exemption is remains unclear.

Judges gave the government until 31 January 2022 to correct the defects in theexemption. They said in their ruling that it did not meet the safeguarding requirements for exemptions listed in General Data Protection Regulations (GDPR). On 26 January 2022 the government laid a statutory instrument to amend the immigration exemption which it claimed remedied the defects.

However, Open Rights Group (ORG) and the3million, which represents EU citizens living in the UK, claim that the exemption is still unlawful and have applied for a second judicial review of the policy, in the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022.

The claimants, again represented by the human rights legal team at law firm Leigh Day, argue the exemption is still unlawful because it does not meet therequirements of being a 'legislative measure' necessary for compliance with Article 23 of the UK GDPR and omits necessary and procedural safeguards required by Article 23.

A legislative measure must be published in full, whereas the statutory instrument allows the Home Secretary to publish the exemption in a redacted format, which infringes the fundamental principle of legal certainty and does not fulfil the requirement to publish in full.

Contrary to the Court of Appeal ruling, the revised exemption is still "non-binding" guidance.

The parts of the exemption which justify restricted access to data for the vague purpose of "immigration control" have been left unamended. The exemption does not clearly and precisely ensure that the requirements of necessity and proportionality are met and does not contain specific provisions required by Article 23.

On 15 June 2022 the ORG and the3million were granted permission to proceed to a full hearing later this year.

Erin Alcock, lawyer in the human rights team at Leigh Day said:

"The Court of Appeal ruling last year was very clear about the safeguards required to bring the Immigration Exemption into compliance with the GDPR. It is disappointing that the statutory instrument laid falls short of what is expected by the law. Our clients feel they have no choice but to take the matter back to court for a second review."

Luke Piper, Head of Policy and Advocacy at the3million said:

"We are pleased that permission has been granted so that this important matter can be considered by the court. We had hoped, after the first challenge, the UK Government would do the right thing and do away with the immigration exemption that denies people their basic data rights. Instead, we are back in court pursuing the safeguards we and every person living in the UK is entitled to."

Meg Foulkes, Head of Policy and Litigation at Open Rights Group, said:

"The Court of Appeal made clear what was necessary to put this matter right. The government's failure to properly comply with these directions means that yet again, we are fighting to ensure that data rights are respected. We remain committed to holding this government to account."

Ben Jaffey QC of Blackstone Chambers and Julianne Morrison and Nikolaus Grubeck of Monckton Chambers are advising in this matter.

Dear backers, 

A happy new year to you and thank you for your continuing and generous support. 

It has been a few months since the Court of Appeal’s decision. The Government in that time have created draft laws to change the immigration exemption in reaction to the court’s decision. Unfortunately, these changes are, in our opinion, not compatible with the GDPR and undermine our data rights. 

The draft law is currently being considered by parliament. We, the3million and ORG, have written to the committee responsible for scrutinising this legislation setting out our concerns. You can read them here. 

The legislation will also be considered by both the House of Commons and Lords at other stages before the end of the month and we will continue to make the case for why these changes are incompatible. 

We would be grateful if you would share our concerns via social media (for example by retweeting/engaging with this tweet)  and your respective colleagues/friends who are interested in this area. 

We will keep you posted but we fear that this issue is far from resolved… 

Warmest data regards, 

Many thanks, 

Luke Piper
Head of Policy and Advocacy at the3million

We are absolutely delighted to announce some huge news this evening, together with a heartfelt thanks to our backers. We absolutely could not have held the Government to account without your financial support.

Below, you will find our press release issued today. We will provide an update as soon as we can to explain the next steps - as a hearing over the summer will determine what legal steps will be taken to fix the unlawfulness of the immigration exemptions.

Immigration Exemption judged unlawful, excessive, wrong by Court of Appeal   

Today the court of appeal has unanimously found that the UK immigration exemption is incompatible with Article 23 of the GDPR. The judgment is a huge win for the Open Rights Group, the3million and their legal team at Leigh Day.

The Immigration exemption allows the government and private sector to circumvent data protection obligations under the vague purpose of “the effective maintenance of immigration control”.

It is in effect a blanket power to refuse information and use it secretly. Millions of people are potentially affected by this restriction of their data The Home Office has already relied on it in as many as 72% subject access requests for personal information.

Although the GDPR allows for restrictions on data protection rights it requires any exemptions to be narrow and have proper safeguards to protect individuals. The importance of such safeguards and limits is obvious from Windrush. The UK has created a hostile environment where private citizens and public servants must check the immigration status of other citizens when offering jobs, when renting accommodation, when visiting a GP or hospital, when opening a bank account, when getting married and more. All these groups count as “data controllers” who could use this new exemption to withhold information they have about a person.

Safeguards have to be in writing and set out in legislation. However, the Government decided to simply ignore this requirement and did not introduce any special safeguards or limits.

The Court of Appeal has found government acted unlawfully. How this unlawfulness should be fixed will be determined at a hearing later in the summer.  

Responding to the Judgment of the Court of Appeal’s judgment, Maike Bohn, Co-founder of 3million said:

"We welcome today’s judgment, especially as we represent millions of EU citizens who for the first time have to hand their personal data to the Home Office and its contractors to be able to stay in the UK. As it stands, the exemption from data protection for foreign nationals hands all the cards to unaccountable parties - a recipe for things to go horribly wrong. Winning the appeal means we can hopefully reintroduce much-needed scrutiny so errors and data misuse cannot go undetected.”

Sahdya Darr, Open Rights Group’s Immigration Policy Manager said “This is a momentous day. The Court of Appeal has recognised that the Immigration Exemption drives a huge hole through data protection law, allowing the Government to deny access to information that may be being used to deny people their rights. If the Government holds information about you, it should only be in the most exceptional circumstances that it is denied to you, such as during a criminal investigation. Treating all immigrants like criminals and suspects is simply wrong.”

Waleed Sheikh and Erin Alcock of Leigh Day said: “We are very pleased that the Court of Appeal has today ruled unanimously that the Immigration Exemption, which allows not only the Home Office but those in the private sector such as landlords, banks and others to bypass fundamental data protection obligations in the name of maintaining immigration control, is unlawful and lacking in sufficient legislative safeguards.”  

Our appeal against the UK Government’s immigration exemption in the Data Protection Act 2018 has received a court date! We will be heard by the Court of Appeal on 23 and 24 February 2021.

the3million and Open Rights Group are looking forward to once again standing up for an accountable immgration system and a fair data protection framework that respects everyone’s right to access their personal data, regardless of nationality or country of origin.

We have also confirmed with the court that the costs risk we need to raise will be £20,000. This cost is set by the Court to limit the Government’s ability to recover legal costs from us.

Can you donate today to help get us towards that goal?

Thank you so much for your support you have shown to our challenge so far, we could not have done it without you. 

Dear backer,

Thank you again for your support and contribution to the case. The High Court judgment was handed down on 3 October 2019. 

It dismissed our judicial review challenging the ‘immigration exemption’ contained in the Data Protection Act 2018. We are disappointed by this outcome and wanted to give you an update on our reflections and what we are going to do next. Spoiler: it’s not over and we need your help now.

We argued at the High Court hearing, that took place on 23 and 24 July 2019, that the exemption is far too broad and is contrary to the General Data Protection Regulations (GDPR). The GDPR was designed to strengthen fundamental rights of data subjects. We argued in our legal case that the immigration exemption does the opposite: enabling government departments to derogate from a wide range of obligations towards individuals in the interest of ‘maintaining effective immigration control’.

Mr Justice Supperstone decided against our case. He found that “the provisions of the exemption set out the purposes for which, and the categories of data to which, it may be applied are, in my view, clear and appropriately delineate”. Because of this, he dismissed our case in full.

We wanted to let you know that this fight isn’t over. Mr Justice Supperstone rejected our request to be granted permission to appeal to the court of appeal. We have decided to appeal to the Court of Appeal directly. 

We need your help to do this so please pledge your support in our new CrowdJustice page: https://www.crowdjustice.com/case/immigrationexemption2

We still believe that the immigration exemption in the Data Protection Act 2018 as it stands breaches fundamental rights. For the government to do this, it must be strictly necessary. We maintain that the law as it stands fails to achieve this.

The exemption is a blunt instrument, poorly defined and ripe for abuse. Access to data is key for an accountable system, that corrects errors in an immigration system that occur at an alarming rate. The importance of this can’t be underestimated. Millions of EU citizens must navigate the Home Office application process to stay in the UK. This exemption removes that ability to correct errors, which could prove decisive in immigration decisions whether to allow a person to remain in the United Kingdom.

As a result of this litigation, we know the exemption is being used and is being used often. Open Rights Group and the3million will continue the fight against the immigration exemption, seeking an immigration system and data protection framework that respects the rights of everyone.

Despite our loss, we were able to gain victory. The Government previously did not inform people when they used the immigration exemption. The Government will now tell people when the exemption is used which will help them if they want to challenge its application.

Once we receive a response in relation to our application for permission, we will update you.

Kind regards,

Nicolas Hatton, the3million

Matthew Rice, Open Rights Group

The High Court judgement handed down today has dismissed our judicial review challenge to the Home Office regarding the ‘immigration exemption’ contained in the Data Protection Act 2018. Open Rights Group and the3million are disappointed by the judgement in the High Court today, and we have applied for permission to appeal. 

Open Rights Group and the3million still believe that the immigration exemption in the Data Protection Act 2018 as it stands breaches fundamental rights. It is a blunt instrument, poorly defined and ripe for abuse. Access to data is key to an accountable system, to correct errors  that occur at an alarming rate in the immigration system. 

The importance of this can’t be overstated. Millions of EU citizens must now navigate the settled status application process to stay in the UK. This exemption removes that ability to correct errors, which could prove decisive in immigration decisions whether to allow a person to remain in the United Kingdom.

We have already won more transparency as a result of this litigation: we now know the exemption is being used, and is being used often. Our case has revealed that the Government has used the GDPR opt-out in response to 60% of its immigration-related data requests since the beginning of 2019. 

Open Rights Group and the3million will continue the fight against the immigration exemption, seeking an immigration system and data protection framework that respects the rights of everyone.  We will be sending a further update in the next few days, explaining in more detail how we will continue our campaign.

Thanks to backers like you, Open Rights Group and the3million are seeking a judicial review of the immigration exemption to the government's Data Protection Act. We are approaching our first hearing in court in the early New Year 2019, to seek a permission to go ahead with the case. The hearing in the High Court of Justice will be open to the public, and we encourage our friends and supporters to attend.

In the meantime we have been corresponding with the Government’s legal department, and have seen that our legal case is forcing them to engage with the problems of this broad exemption and its uses.

We will be in touch early in the new year as soon as there are further developments. Until then, we wish our backers a Merry Christmas and thank you for your support in 2018.

Thanks to backers like you, we have been able to seek a judicial review of the immigration exemption to the government's Data Protection Act in the last few days. Our legal challenge to the unnecessary and discriminatory exemption is now a reality. 

Our last few weeks of correspondence with government lawyers have not convinced us the immigration exemption is necessary: we still believe it undermines the transparency and protection of personal data that GDPR legislation was meant to strengthen, and creates a two tier system with fewer data protection rights for immigrants than British citizens. 

This week, a pilot programme opened for the new post-Brexit "settled status" scheme for EU citizens  - bringing home that this exemption will affect a whole new group of 3.6 million people along with others already involved in immigration cases. 

We have seen in recent months that the Home Office is prone to errors and delays, and that is why we need to protect the fundamental right for people to access the data held about them to be able to appeal decisions and correct errors. 

We thank you again for your support, and will keep you updated as the case progresses.

Dear backer and supporter of the access2justice challenge,

We made it!!  Thanks to your support, our crowdfunding challenge raised £40,300 in  just under 9 weeks - achieving our £40,000 target to take on the government over the immigration exemption to the Data Protection Act 2018. 

It helped that Shadow Digital Minister for Labour Liam Byrne MP wrote in support of our challenge in the Huffington Post - calling the exemption a “gratuitous land grab” by the Home Office:

https://www.huffingtonpost.co.uk/entry/home-office_uk_5b3f9f27e4b07b827cc02136  

Our crowdfunder is now closed for donations, but these contributions from you and many others mean that Open Rights Group and the3million are now in a strong position to seek a judicial review of the Data Protection Act.  

We are taking advice from the legal counsel handling our case on the next steps to take -  watch this space for more updates, and  continue to follow and retweet us on @The3Million and @OpenRightsGroup.

Thanks to everyone who donated to this action by Open Rights Group and the3million, tweeted about the case and shared with their friends. 

Kind regards -

Martha Dark, Open Rights Group

Nicolas Hatton, the3million

We have one more week to hit our target of £40k to help with our challenge to the Immigration Exemption. 

7 days to raise roughly £7k. Thanks to everyone who has donated to this action by Open Rights Group and the3million, tweeted about the case and shared with their friends. With just a little more support we’ll easily meet that £40k target.

We’re currently preparing our arguments to submit to the court and thanks to your support we will be ready to do that soon.

Meanwhile, Government ministers have in recent weeks sought to downplay concerns about the law. Sajid Javid, the Home Secretary, promised that EU citizens will be able to access data held about them.  These promises are just that, promises. The exemption is still in the law. It is still deeply vague what is meant by “effective immigration control”. Despite the Home Secretary’s promise, there is no special category of protection for EU citizens or anyone else against this exemption being used on them.

Besides, this is about more than just EU citizens living in the UK, this is about anyone going through, or connected to a person going through, an immigration process.

The whole of the Immigration Exemption needs to go. From the restriction of the right to access data held about you to the lifting of restrictions for sharing data between data controllers (whether that is the Home Office, your local school, or your employers) the exemption is a wildly disproportionate interference with the fundamental right to protection of data.

Everyone has the right to data protection and everyone’s right to data protection is threatened by this exemption. Take a stand for #access2justice.

Open Rights Group

the3million

Do you care about guaranteeing data protection rights for everyone, no matter where they were born?

We do and thanks to all the amazing citizens who are supporting our case, we have now reached our primary target of raising £30k for our legal challenge to remove the immigration exemption from the Data Protection Act. 

This is a significant milestone - we are now confident of having the financial resources to cover our legal costs in taking the Government to court. 

We have just a few days left of our fundraising challenge, and we have raised our final target to £40k. 

Contributions made in the final days of the challenge will go towards funding the hard work that Open Rights Group and the3million are putting into campaigning on the Data Protection Act, and towards preparing and building support for our court case. 

Without you, we wouldn’t be in a position to take up this fight, and we thank you for making this possible. 

Please continue to tweet about the challenge on #access2justice, follow us on Twitter at @The3Million and @OpenRightsGroup and promote this fundraising page on your social media channels.

Kind regards,

Martha and Nicolas

Martha Dark, Open Rights Group

Nicolas Hatton, the3million

The Data Protection Act including the Immigration Exemption has now received Royal Assent. Thanks to people like you we hit the ground running. Our campaign reached our initial target of £10,000 within just 48 hours and thanks to your support, we are close to our goal of raising £30,000.

The bill has now been passed in to law including the exemption despite our efforts to have it removed. Open Rights Group and the3million are now going to move forwards on challenging the immigration exemption together with our legal counsel.

We need your help with the next steps, we need to raise another £5,400. With your help we can make the 2018 Data Protection Act do what it was meant to - enhance people’s control over their personal data. The exemption will achieve the opposite aim of denying people access to their data when they need it most. The peace of mind of millions of legal UK residents reapplying for a new immigration status after Brexit is at stake.

Open Rights Group and the3million thank you again for your support in challenging this exemption. Please help continue the momentum by sharing our message tweeting your support on access2justice.

Thank you,

Open Rights Group and the3million

Dear backer and supporter of the access2justice challenge,

You have been wonderful in the last 24 hours, as we have almost reached our first £10,000 target. This means we can progress our legal challenge, knowing we will have the financial resource to take the Government to court.

To do so, we will need to collect another £20,000 in the next 29 days, so please share the crowdJustice page widely, so me and everyone who has to deal with the Home Office to continue to live their lives in the UK can retain their #access2justice and not be denied access to their own data by the Home Office. 

The process will take between 6 to 9 months so we will update you with regular updates.

Yesterday, the Data Protection Bill came back to the House of Commons and the cross-party amendment, which would have removed the exemption, was defeated by 28 votes so the bill will now become law with the built-in exemption but the battle is only starting.

As per the3million's campaign for EU citizens' rights and the Open Rights Group's campaign for the rights to privacy and free speech online, this is about hope and fighting for a better future for all. 

So once again, a massive thank you to you, who believed in us from the start. You are amazing. 

Please share widely and spread the message that we can win this and restore some sense of justice to those who need it most.

Kind regards,

Nicolas Hatton

Founder member of the3million