Violating data protection law under the guise of protecting it


Matthew White, PhD candidate
Sheffield Hallam University.

Introduction

There have been numerous reports
of Windrush Generation Commonwealth citizens being denied
health care
, detained,
losing
jobs
and threats
of deportation
. Nick
Nason
describes the Windrush Generation as Commonwealth citizens from the
West Indies who were invited to the UK after WWII to address the shortage of
workers at the time. There was a time when West Indians enjoyed total
freedom of movement. Nason notes
that s.2(2)(b) of the Commonwealth
Immigrants Act 1962
exempted from immigration controls those who arrived
with their parents and were under 16. And this is still true for children who
arrived prior to 1 January 1973, as Nason puts
it
, they are ‘in the UK legally.’   

Destroying personal data on data protection grounds

The Home Office then relied
upon data protection law to justify deletion by arguing that keeping personal
data for longer than necessary was in breach of data protection principles.
More specifically, Robert Peston tweeted that
the Home Office relied upon the Fourth and Fifth data protection Principles
found in Schedule
1
of the Data Protection Act 1998 (DPA 1998).
The actions of the Home Office in
relation to the destruction of personal data does not just have implications with
regards to the DPA 1998 but also under the European
Convention on Human Rights
(ECHR), particularly Article 8 which provides
that:

1.      Everyone
has the right to respect for his private and family life, his home and his
correspondence.

2.      There
shall be no interference by a public authority with the exercise of this right
except such as in accordance with the law and is necessary in a democratic
society in the interests of national security, public safety or the economic
well-being of the country, for the prevention of disorder or crime, for the
protection of health or morals, or for the protection of the rights and
freedoms of others.

According to the European Court
of Human Rights (ECtHR) Grand Chamber (GC) in S and Marper
(ECHR, 4 December 2008) the ‘protection of personal data is of fundamental
importance to a person’s enjoyment of his or her right to respect for private
and family life, as guaranteed by Article 8 of the Convention’ [103]. The mere
storage of personal data interferes with Article 8 [67]. The GC continued that ‘domestic
law must afford appropriate safeguards to prevent any such use of personal data
as may be inconsistent’ with Article 8 [103]. The Home Office’s position on not
storing personal data for longer than is necessary is consistent with the
ECtHR’s approach [ibid], but this would be classed as subsequent [67, 121] use
and thus is still an Article 8 issue.
The first requirement under
Article 8 is whether the deletion of personal data was ‘in accordance with the
law.’ This requires there to be some basis in domestic law
[193]. One could argue the DPA 1998 itself provides the domestic law basis for
deletion, but the ECtHR has previously held that it does not
have to assess ‘the quality of the applicable data protection framework in the
abstract and must rather confine itself as far as possible to examining the
particular consequences of application of its provisions in the case before it’
[81]. This is due to the fact that reliance on the DPA 1998 does not guarantee an action to be
‘in accordance with the law’ [207]. The ECtHR has stressed that applicable laws
must provide:

[C]lear,
detailed rules governing the scope and application of the relevant measures; as
well as minimum safeguards concerning, inter alia, duration, storage, usage,
access of third parties, procedures for preserving the integrity and
confidentiality of data and procedures for their destruction, thus providing
sufficient guarantees against the risk of abuse and arbitrariness at each stage
of its processing [75].

Therefore, the legal basis for
the destruction of personal data in the context to which the Home Office relies
becomes severely weakened. The DPA 1998 does not define the scope and
application with clear, detailed rules as to when the Home Office is entitled
to delete personal data, nor does it provide procedures for said destruction. The
arbitrariness of the measure is apparent when it is clear that the Home Office
deleted all said personal data en masse.

Moreover, even if one were to
consider the DPA 1998 as the correct legal basis that is sufficient in ECHR
terms, this does not answer the question as to why the Fourth Principle was
used in this manner. The Home Office are essentially arguing that personal data
held on Windrush Generation individuals were inaccurate, without actually
taking reasonable steps to ensure the accuracy of said data in contravention of
Schedule 1, Part II (7)(a) of the DPA 1998. When the domestic authorities do
not even observe their own law, this would also violate Article 8 [45-9]
The lawful basis in this context
is strongly linked to whether a measure satisfies the ‘quality of the law’ in
which a law should be accessible
to the person concerned and foreseeable to its effects
[50]. This is
usually satisfied when a law is published [52-3]. However
it has been argued that the vagueness of the DPA 1998 provides an insufficient
legal basis for the destruction of personal data in this context. In arguing
so, it cannot be said the law is accessible, because there is no law to access,
which in and of itself would violate
Article 8
[69-70].
Regarding foreseeability, this is
described as formulating
the law:

[W]ith
sufficient precision to enable the individual – if need be with appropriate
advice – to regulate his conduct. For domestic law to meet these requirements,
it must afford adequate legal protection against arbitrariness and accordingly
indicate with sufficient clarity the scope of discretion conferred on the
competent authorities and the manner of its exercise [95].

The level of precision ‘depends to a
considerable degree on the content of the instrument in question, the field it
is designed to cover and the number and status of those to whom it is addressed’
[96]. The DPA 1998 was designed to cover the protection of (sensitive) personal
data, but not specifically in the immigration context, thus its Principles are
not precise [98]. The
DPA 1998 would not indicate to any Windrush Generation individual as to when or
under what circumstances their personal data may be deleted by the Home Office,
thus not providing sufficient clarify on the scope of their discretion.
This discussion on the
unlawfulness of the Home Office’s reliance could have stopped at the end of the
last paragraph, but it is important to consider the case of Kurić and others v Slovenia (ECHR, 13 July 2010) as it shares
similarities with the Windrush Generation scandal. The applicants in this case
complained before the ECtHR that the erasure of their names from the Register
of Permanent Residents made them aliens overnight which denied them ‘civil,
political, social and economic rights’ [319].

The applicants had been living in
Slovenia for years, and most of them decades, some were even born there [356]. The
applicants did not enter Slovenia as immigrants but as settled citizens [357].
Moreover, the applicants had a stronger residence status than long-term
migrants and those seeking to enter or remain [357]. Although not identical,
the erasure of landing cards made it more difficult for Windrush Generation individuals
to prove they had a right to live in the UK, and due to this lack of proof they
could be denied healthcare, jobs, bank accounts etc.

In that case, the ECtHR
reiterated previous case law in that Article 8 is interfered with when the ‘persons
concerned possess strong personal or family ties in the host country which are
liable to be seriously affected by application of the measure in question’
[351]. They continued that the right to establish and develop relationships,
embracing social identity, having social ties with the community all fall
within the meaning of Article 8 [352]. Moreover, Article 8 is interfered with
when one faces expulsion and having their citizenship arbitrarily denied
[352-3]. Finally, the UK Government has positive obligations to respect Article
8 [354].

Due to the cumulative failings of
Slovenia, the ECtHR concluded there was a violation of Article 8 [376]. The
ECtHR did not decide whether the Article 8 violation was due to the measures
not being ‘in accordance with the law’ pursued a legitimate aim or was
‘necessary in a democratic society,’ so the same approach will be taken to
argue that in the cumulative, Article 8 has been violated. When one considers
that landing cards had been destroyed arbitrarily in 2010, the Home Office claimed
these had no impact on the rights of the Windrush Generation. This claim is contested
by two Home Office whistle blowers arguing that the landing cards had been a
useful resource. The whistle blower’s account is supported by the Border Force
where its notes state that ‘Information
from a landing card may be used by an entry clearance officer in making a
decision on a visa application
.’ Destroying landing cards allowed Home
Office staff to tell those concerned that they had no
record
of arrival dates which would lead to the denial of services and at
worst, deportation.
Moreover, citing data protection
law as a reason for the destruction of personal data appears cynical
due to the amount of personal data that is kept anyway and the fact that the
same Government is seeking to create an immigration exemption in the new Data
Protection Bill
(Schedule 2, Part 1, (4). The Home Office also explained
that it considers alternative
evidence
such as tax records, utility bills and tenancy agreements as
evidence of ongoing residency. However, if one can be denied work, have bank
accounts frozen and be denied tenancy, then this evidence could also be
difficult to provide. The cumulative effect of denial of services to the threat
of (or actual) deportation, the deletion of flying cards and the spurious
reasoning behind it would amount to a violation of Article 8.

The racist elephant in the room

Nason asked
whether the overt racism from the 1960s-80s has simply been replaced ‘by a more
insidious, state-endorsed hostility in the name of immigration control.’ A
group of NGOs published a report
on the ‘hostile environment’ noting that its very nature is discriminatory and
thus encourages discriminatory or even racist behaviour. Former Home Office
employees detail
how the ‘hostile environment’ changed the attitude of staff to the point where
they enjoyed catching out Windrush individuals without evidence. James Moore argues
that this is what happens when you let dog-whistle racism go mainstream.
Article 14 of the ECHR details
how the enjoyment of rights contained in the ECHR must be protected in a
non-discriminatory manner. The grounds for discrimination are non-exhaustive
but include race, colour, national or social origin and birth. Any one of these
can be relevant to the Windrush Generation. Article 14 only works in
combination with another substantive Convention Right, in this instance Article 8 [84]. Article 14
requires a difference in
treatment to those in an analogous or similar situation
[66]. The ECtHR
have maintained that:

[A] difference
in treatment may take the form of disproportionately prejudicial effects of a
general policy or measure which, though couched in neutral terms, discriminates
against a group…may amount to “indirect discrimination”, which does not
necessarily require a discriminatory intent [184].

The Windrush Generation have as
much right to be here as any other UK citizen, yet they are the ones that a
targeted under the ‘hostile environment.’ Given that the Home Office destroyed
landing cards, removed key protections that could have avoided this. One could
argue the actions of the UK Government are more than just indirect
discrimination because the discriminatory intent arises for the poor reasoning
for destruction of flying cards to the lack of reasoning for removing key
protections. The Government has no objective reasonable justification for this
difference in treatment and thus amounts to discrimination [196]. Moreover, the
Windrush Generation are being treated as though they are immigrants. This
engages a different type of discrimination issue under Article 14, a Thlimennos discrimination
which notes that:

The right not
to be discriminated against in the enjoyment of the rights guaranteed under the
Convention is also violated when States without an objective and reasonable
justification fail to treat differently persons whose situations are
significantly different [44].

Conclusions

This post has highlighted that
the dubious reasoning as to why the Home Office destroyed crucial information
that could have helped prevent some of the tragedies of the Windrush Generation
is flawed, logically and legally. Not only is it flawed, reliance on data
protection grounds in ECHR terms would amount to using Article 8 as a shield,
and for the UK Government to do so would raise serious questions regarding
Article 17 (the abuse of rights). Not only is the Home Office’s actions and
reasoning in violation of Article 8, it violates Article 8 on the ground of
defending it. There is a bigger issue which highlights the resurfacing of
racism and discrimination in a new form which violates Article 8 in conjunction
with Article 14. The ‘hostile environment’ has provided a platform and has
legalised discrimination and racism, the destruction of landing cards in 2010
can be seen as the first steps towards this, and the removal of key protections
for the Windrush Generation in the 2014 Act  is no accident either. The ‘hostile
environment’ is the problem and the recent outrages shows that there are ‘resources
of hope, but time is running out – we are at five minutes to midnight
.’





Source link

Related posts

Leave a Comment