The Data Protection Act lets the Home Office withhold immigrants' own records from them, and the Court of Appeal found that exemption unlawful twice. Parliament added safeguards in 2024, but the only public count of its use still dates from 2020.
Estimated reading time: 7 minutes
In short. Schedule 2 to the Data Protection Act 2018 lets the Home Office withhold someone's own immigration records from them, if giving access would be likely to prejudice immigration control. The Court of Appeal found that exemption unlawful in 2021 for failing to write specific safeguards into law. The government's fix, in 2022, put those safeguards in a policy document instead of the Act, and the Court of Appeal found that unlawful too, in 2023, for the same underlying reason. The safeguards finally written into the Act itself in March 2024 include a duty to record every use of the exemption. Two and a half years on, the most recent public figure for how often it is actually used is a Freedom of Information disclosure from 2021, covering 2020. Three documented mistakes: four stars.
Since 25 May 2018, the day the Data Protection Act 2018 took effect, one part of it has let the Home Office refuse to hand over the very information it holds on the people it holds it about. Two Court of Appeal judgments have since found that provision unlawful, in 2021 and again in 2023, for the same underlying reason both times. The version of the law now in force is the government's third attempt at getting it right. Whether it works is unmeasured in public, because nobody in government has published a usage figure since before any of the litigation happened.
An exception with no numbers attached
Paragraph 4(1) of Schedule 2 to the Act says the "relevant UK GDPR provisions do not apply to personal data processed by the Secretary of State" for "the maintenance of effective immigration control" or "the investigation or detection of activities that would undermine" it, wherever applying those provisions "would be likely to prejudice" either purpose [1] (Schedule 2, paragraph 4(1)). The provisions it can switch off include the right to be told what data is held, the right to see it, and the right to have it corrected or erased. In practice, that has meant Home Office caseworkers refusing subject access requests from visa applicants, asylum seekers and settled migrants on the grounds that answering them might tip someone off about how immigration enforcement works.
How often that happens is not routinely published. The one figure on the public record came from a Freedom of Information request, not a government release: 14,027 of 19,305 subject access requests made to the Home Office in 2020, or 72.6 per cent, had the exemption applied [2]. That disclosure is now more than five years old.
Found unlawful once, for missing safeguards Parliament could see
Open Rights Group and the3million challenged the exemption from the year it was created, arguing it breached Article 23(2) of the GDPR, which requires that any law restricting data rights contain "specific provisions" on matters including its scope, safeguards and the categories of data affected. The Court of Appeal agreed, ruling on 26 May 2021 that "there presently exists no legislative measure that contains specific provisions in accordance with the mandatory requirements of Article 23(2)" [3] (paragraph 29). The exemption as originally drafted, the court found, said "nothing, specific or otherwise, about any of the matters listed in Article 23(2)" [3] (paragraph 53). ICO guidance describing how the exemption should be used did not count, because guidance has no binding force and Parliament had not approved it.
Found unlawful a second time, for the same underlying reason
The government's response was the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022, in force from 31 January 2022, which added new sub-paragraphs requiring the Secretary of State to maintain an "immigration exemption policy document" explaining "the Secretary of State's policies and processes" for applying the exemption [4]. Open Rights Group and the3million challenged that too, and on 11 December 2023 the Court of Appeal found it unlawful for the same underlying reason as before: the actual safeguards still were not written into the law. Lord Justice Singh put it plainly: "what the Secretary of State is saying to Parliament is that there will be additional safeguards but is not willing to tell Parliament what they are" [5] (paragraph 62). A policy document the Home Office could rewrite on its own, without Parliament seeing the changes, was not a "legislative measure" in the sense Article 23(2) requires. The court suspended its declaration for three months to give the government time to fix it [5] (paragraph 104).
The version now in force
The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024 were made on 7 March 2024 and came into force the next day, one day inside the court's deadline [6]. They deleted the policy-document approach and wrote the safeguards directly into new paragraphs 4A and 4B of Schedule 2. Paragraph 4A now requires the Secretary of State to decide on a "case by case basis", to weigh "any potential vulnerability of the data subject", and to apply the exemption only where the risk to immigration control is a "substantial risk" that "outweighs" the risk to the person's own interests and where doing so is "necessary and proportionate" [7]. Paragraph 4B requires the Secretary of State to "keep a record" of each such decision "and the reasons for it", and to inform the person affected unless doing so would itself be prejudicial [8].
The Information Commissioner's Office reviewed the draft before it took effect and told the Home Office it satisfied the Court of Appeal's judgment: "after careful examination, we have determined that they satisfy the requirements of the judgment" [9]. The same statement was not an unqualified pass: Deputy Commissioner Emily Keaney added that "staff working in immigration must be made aware of these changes and trained appropriately" [9], a condition whose fulfilment nobody outside the Home Office can check, because there is no published record of the training having happened.
A record that is kept and never counted
Paragraph 4B's recording duty answers the question of whether a decision happened. It does not answer how many decisions happened, because nothing requires the Home Office to publish the aggregate. The ICO's own current guidance, last updated on 8 March 2024, sets out the case-by-case test and the record-keeping and notification duties in full, and contains no statistics, audit findings or review data on how the Home Office actually uses the exemption [10]. The Home Office's own published guidance on requesting personal data from UK Visas and Immigration, Border Force and Immigration Enforcement, last updated on 4 August 2026, more than two years after paragraph 4B took effect, contains no figures either [11]. The 72.6 per cent figure from 2020 remains the only number in public circulation, and it predates every safeguard the Act now contains.
The claims, tested
| The document's own words | What the evidence actually shows | Verdict |
|---|---|---|
| The exemption applies "to the extent that" using data rights "would be likely to prejudice" immigration control (Schedule 2, paragraph 4(1)) [1] | The Court of Appeal found in 2021 that this test, unaccompanied by specific legislative safeguards, breached Article 23(2) of the GDPR [3] | The original exemption did not meet the law it was supposed to comply with |
| The 2022 fix required an "immigration exemption policy document" setting out safeguards [4] | The Court of Appeal found in 2023 that a policy document Parliament had not approved could not supply the "specific provisions" Article 23(2) requires [5] | The second attempt repeated the first attempt's core defect |
| Paragraph 4B, in force since March 2024, requires a record of "it and the reasons for it" [8] | No published statistic, audit or review has followed; the most recent public figure is a 2020 FOI disclosure predating the safeguard [2] [11] | The record exists somewhere inside the Home Office; the public sees none of it |
The mistakes, counted
The exemption was found unlawful twice, for the same underlying defect (1). In 2021 the Court of Appeal found the original exemption lacked the specific legislative safeguards Article 23(2) requires [3] (paragraph 29). In 2023 it found the government's first attempt at a fix repeated that defect by putting the real safeguards in a policy document rather than the law [5] (paragraph 62). Two rewrites were needed before Parliament, rather than the Home Office alone, could see what the safeguards actually said.
A recording duty with no publication duty attached (2). Paragraph 4B requires the Secretary of State to keep a record of each decision to apply the exemption and the reasons for it [8], but nothing in the Act or the 2024 Regulations requires that record, or any total drawn from it, to be published or reported to Parliament. The safeguard the court demanded exists as an internal file, not a public account.
Over five years without a published figure (3). The only public number on how often the exemption is applied, 72.6 per cent of Home Office subject access requests in 2020, came from a Freedom of Information request in 2021, not a routine release, and predates the exemption's current safeguards entirely [2]. The Home Office's own current guidance on requesting personal immigration data, updated as recently as 4 August 2026, still carries no equivalent figure for any year since [11].
Credit where due
The 2024 Regulations did what the courts actually asked for. The case-by-case test, the balancing requirement and the record-keeping duty in paragraphs 4A and 4B are now on the face of primary legislation, subject to the same parliamentary procedure as the rest of the Act, not tucked away in a document the Home Office could amend unilaterally, and the Information Commissioner's Office reviewed the draft independently rather than waving it through unread, flagging the training point rather than staying silent [9]. Unlike its two predecessors, this version of the exemption has not, as far as the public record shows, been struck down or successfully challenged since it took effect. That is a real improvement on the two provisions that came before it, even though it has not yet been tested on the one question this piece could not answer: how often it is actually used.
Verdict
Four stars, from three documented mistakes. A provision that has twice failed the basic legal test set for it, and needed two Court of Appeal judgments five years apart to get the safeguards written into the law itself rather than a document the department controlled alone, is not a small drafting slip. The version now in force finally answers the courts' objection on paper. It does not answer the public's: whether the exemption is used more carefully than it used to be is a question only the Home Office's own unpublished file can settle, and it has chosen not to.
Sources
- Data Protection Act 2018, Schedule 2, paragraph 4, legislation.gov.uk, The National Archives
- Documents reveal controversial Immigration Exemption used in 70% of access requests to Home Office, Open Rights Group, 3 March 2021
- R (Open Rights Group and the3million) v Secretary of State for the Home Department [2021] EWCA Civ 800, Court of Appeal, 26 May 2021
- The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2022, legislation.gov.uk, The National Archives, made 26 January 2022, in force 31 January 2022
- R (the3million and Open Rights Group) v Secretary of State for the Home Department [2023] EWCA Civ 1474, Court of Appeal, 11 December 2023
- The Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024, legislation.gov.uk, The National Archives, made 7 March 2024, in force 8 March 2024
- Data Protection Act 2018, Schedule 2, paragraph 4A, legislation.gov.uk, The National Archives
- Data Protection Act 2018, Schedule 2, paragraph 4B, legislation.gov.uk, The National Archives
- ICO responds to Home Office's draft regulations to the immigration exemption, Information Commissioner's Office, 12 February 2024
- Immigration exemption: a guide, Information Commissioner's Office, updated 8 March 2024
- Requests for personal data: UK Visas and Immigration, GOV.UK, Home Office, updated 4 August 2026