The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Draft Regulations laid before Parliament under section 16(3) of the Data Protection Act 2018, for approval by resolution of each House of Parliament.

Draft Statutory Instruments

2024 No. XXX

Data Protection

The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024

Made

***

Coming into force in accordance with regulation 1(2)

The Secretary of State makes the following Regulations in exercise of the powers conferred by sections 16(1)(b) and (2)(a) and 182(5) of the Data Protection Act 2018(1).

In accordance with section 182(2) of that Act, the Secretary of State has consulted the Commissioner(2) and such other persons as the Secretary of State considers appropriate.

In accordance with section 16(3) of that Act(3), a draft of this instrument has been laid before, and approved by a resolution of, each House of Parliament.

Citation, commencement and extent

1.—(1) These Regulations may be cited as the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.

(2) These Regulations come into force on—

(a) 8th March 2024, or

(b) if later, the day after the day on which they are made.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

Amendment of paragraph 4 of Schedule 2 to the Data Protection Act 2018

2.—(1) Paragraph 4 of Schedule 2 to the Data Protection Act 2018(4) (immigration) is amended as follows.

(2) In sub-paragraph (1), for “UK GDPR provisions listed in sub-paragraph (2)” substitute “relevant UK GDPR provisions”.

(3) Omit sub-paragraphs (1A) and (1B).

(4) In sub-paragraph (1C)—

(a) omit “additional”;

(b) for “this paragraph” substitute “sub-paragraph (1)”.

(5) In sub-paragraph (2), for “The UK GDPR provisions referred to in sub-paragraphs (1) and (1B)” substitute “In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions””.

Substitution of new paragraphs 4A and 4B of Schedule 2 to the Data Protection Act 2018

3.  For paragraphs 4A and 4B(5) of Schedule 2 to the Data Protection Act 2018, and the italic headings above those paragraphs, substitute—

“Immigration: safeguards: immigration exemption decisions

4A.— (1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “an immigration exemption decision”) must be made in accordance with this paragraph.

(2) An immigration exemption decision must be made—

(a) on a case by case basis,

(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

(a) any potential vulnerability of the data subject that is relevant to the decision,

(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

(c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—

(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009(6) (duty regarding the welfare of children), and

(iii) the need to ensure compliance with the UK GDPR.

(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

(5) In this paragraph—

“Convention rights” has the same meaning as in the Human Rights Act 1998(7) (see section 1(1) of that Act);

“the Refugee Convention” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol(8);

“the Trafficking Convention” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005(9).

Immigration: safeguard: record of decision that exemption applies

4B.— (1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.

(2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b).”.

Name

Parliamentary Under Secretary of State

Home Office

Date

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations amend the immigration exemption in Part 1 of Schedule 2 to the Data Protection Act 2018 (c. 12) (“the 2018 Act”). These amendments are made in consequence of the judgment of the Court of Appeal in the case of R. (on the application of the 3million and Open Rights Group) v. Secretary of State for the Home Department and Secretary of State for Science, Innovation and Technology (formerly Secretary of State for Digital, Culture, Media and Sport), and The Information Commissioner as an Interested Party ([2023] EWCA Civ 1474).

The immigration exemption allows certain specific rights and obligations in the UK GDPR to be restricted to the extent that giving effect to those rights and obligations would be likely to prejudice: (a) the maintenance of effective immigration control, or (b) the investigation or detection of activities which would undermine the maintenance of effective immigration control.

The immigration exemption was amended by S.I. 2022/76 to add safeguards to the exemption.

These Regulations further amend the immigration exemption to amend the safeguards and ensure that safeguards relating to decision-making are set out on the face of the legislation.

Regulation 2 amends paragraph 4 of Schedule 2 to the 2018 Act so that it provides only for the exemption itself and the provisions of the UK GDPR to which the immigration exemption can apply (“relevant UK GDPR provisions”). It revokes the provisions relating to the immigration exemption policy document and its role in decision-making.

Regulation 3 substitutes new paragraphs 4A and 4B into Schedule 2 to the 2018 Act. Paragraph 4A sets out safeguards relating to decision-making. Paragraph 4A:

a)

provides that immigration exemption decisions are made on a case by case basis;

b)

provides that the Secretary of State must make a separate decision in respect of each of the relevant UK GDPR provisions which relates to the data subject;

c)

provides that the Secretary of State must make a fresh decision on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions in relation to the data subject;

d)

sets out essential considerations for decision-making under paragraph 4(1): that the Secretary of State takes into account all the circumstances of the case including at least any potential vulnerability of the data subject relevant to the decision, all the rights and freedoms of the data subject including the data subject’s Convention rights and any relevant duties or obligations including the UK’s obligations under the Refugee Convention and Trafficking Convention, duties under section 55 of the Borders, Citizenship and Immigration Act 2009 (c. 11) (the need to safeguard and promote the welfare of children in the United Kingdom) and the need to comply with the UK GDPR;

e)

provides that a decision to apply the exemption may be made only if the application of the particular UK GDPR provision would give rise to a substantial risk of prejudice, that risk outweighs the risk of prejudice to the interests of the data subject and the application of the exemption is necessary and proportionate to the risks in the particular case.

Paragraph 4B(1) provides that the Secretary of State must keep a record of any decision that the immigration exemption applies and the reasons for that decision. Paragraph 4B(2) provides a rebuttable presumption that the data subject be informed of the use of the immigration exemption.

A full impact assessment has not been produced for this instrument as no, or no significant, impact on the private, voluntary or public sector is foreseen.

(1)

2018 c. 12 (“the 2018 Act”). Section 16 was amended by S.I. 2019/419. There are amendments to section 182 not relevant to these Regulations.

(2)

“The Commissioner” is defined in section 3 of the 2018 Act.

(3)

For the meaning of “the affirmative resolution procedure” see section 182(7) of the 2018 Act.

(4)

Part 1 of Schedule 2 was amended by S.I. 2019/419 and 2022/76.

(5)

Paragraphs 4A and 4B were inserted by S.I. 2022/76.

(6)

2009 c. 11.

(7)

1998 c. 42.

(8)

United Nations Treaty Series, vol. 189, p. 137 and vol. 606, p. 267.

(9)

Cm 8414.