In the case of R (Open Rights Group & the 3 million) v Secretary of State for the Home Department [2019] EWHC 2562 (Admin) an attempt was made to challenge the immigration exemption in the GDPR.

This provides any data controller (not only the authorities) with certain exemptions regarding the processing of personal data for “the maintenance of effective immigration control” or “the investigation or detection of activities that would undermine the maintenance of effective immigration control.”

In particular the exemptions allow data controllers to avoid informing the data subject about their data being processed, and limit the data subject’s rights to access their data and request erasure.

The claimants argued that this is too broad and amounts to a breach of other provisions of the GDPR, of their human rights and that it was discriminatory. The Information Commissioner also intervened and argued that statutory guidance should be required to ensure the exemption was used properly.

However, the High Court found that the immigration control exemption was justified and it was sufficiently clear that statutory guidance was not required. The claimants are seeking permission to appeal to the Court of Appeal and we expect this case to rumble on for some time yet.

This article is from the October 2019 issue of Employment and Immigration Law Update, our monthly newsletter for HR professionals.