An application for judicial review was filed in the UK High Court on 28 August 2018, seeking to have the immigration exemption in the UK’s Data Protection Act 2018 (“DPA 2018”) removed on the grounds that it is incompatible with the General Data Protection Regulation (“GDPR”) and the Charter of Fundamental Rights of the European Union (“EU Charter”).

The DPA 2018 provides that certain GDPR rules do not apply where personal data is processed for the maintenance of effective immigration control, or the investigation or detection of activities that would undermine the maintenance of effective immigration control (the “Immigration Exemption”). The Immigration Exemption removes a number of rights of data subjects, including the rights to restrict or object to processing and the right to erasure.

The legal challenge was brought by two organisations, the Open Rights Group and the 3million, which raised funds for the judicial review through public crowdfunding. In their application, the groups ask the court to declare that the Immigration Exemption be struck out on the basis that it is (1) contrary to Article 23 of the GDPR, (2) incompatible with Articles 7 and 8 of the EU Charter, and (3) discriminatory towards EU citizens.  Article 23 of the GDPR allows EU Member States to restrict the rights excluded by the Immigration Exemption in their own national legislation as long as such a restriction respects the essence of the fundamental rights and freedoms, and is a necessary and proportionate measure in a democratic society.  Article 7 addresses respect for privacy and family life, while Article 8 addresses the protection of personal data.

The two organisations are concerned that the concept of “effective immigration control” is not clearly defined and that the broad wording of the Immigration Exemption means that it could prevent individuals from accessing all personal data held by public bodies that are in some way involved with UK Home Office immigration decisions. The groups contend that by denying data subjects access to the personal data being used in immigration processes, there is a risk that inaccurate data may be used to make important decisions (such as decisions relating to deportation) and allow mistakes to go unchallenged. This is a particular concern for EU citizens living in the UK (who the 3million represents) as they will have to apply to the Home Office through an online application process for “settled status” after Brexit.