A coach and horses through privacy rights

I have just been approached by a Trade Union member who wanted to know how to complain about his employer’s record keeping. The short answer is to complain to the Information Commissioner’s Office. It reminded me that the ORG are campaigning to change the current Data Protection Bill to allow non-profits to represent complainants; this reminds me that Trade Unions might also want to benefit from this legislative protection, but I was horrified by the Government’s proposed exemption of immigration data from the remit of the Data Protection law and thus the GDPR. 

On reading the ORG blog article, I was horrified to learn that the Government propose to write a GDPR Article 23 Restriction on data subject rights for all immigration processing data. There are two problems with this, the first is that the number of complaints received by the ICO against the Home Office for Data Protection, and informally, from reports of MPs postbags are predominately about immigration processing. The second is that the development of Theresa May’s “hostile environment”, means that record keeping is now often the responsibility of schools, GPs, hospitals, landlords, employers and even the DVLA. This is a coach and horses through the GDPR, particularly for EU citizens resident in the UK.

The unspoken truth here, is that Home Office considers itself above the law, (see also here…) and in this case has decided to write its assumed immunities into the law. The other reason is that these co-opted agents of the surveillance state don’t want to pay for it, and certainly don’t want to pay for data protection compliance and neither do the government. The Home Office does not deserve our trust and the civil entities collecting and processing this data shouldn’t be doing it, and certainly not with immunity.

This proposal is disproportionate and morally wrong.

2 Comments.

  1. If we remain in the EU, this law will be subject to review by the CJEU, and if we leave, the EU Law will require the UK to have an “Adequacy” ruling which is given by the Commission under the supervision of the CJEU.

    In the case of Brexit, EU citizens, but not UK citizens will retain the right to approach the CJEU for judicial review. So much for taking back control. This right of access will be via the Adequacy agreement, not any transitional agreement.

  2. I suppose there’s an article on the change in rights by transferring the lawful purpose from contract, or consent to public interest. I also argue it’s only the immigration data that has exemption. the identification facts and correspondence addresses will still be subject to the DPA and data subject rights. (How useful an exemption is this for the civil society entities?)