The Information Commissioner’s Office (ICO) has issued an enforcement notice and a warning to the Home Office for failing to sufficiently assess the privacy risks posed by the electronic monitoring of people arriving in the UK via unauthorised means.
Discussions have been ongoing between the ICO and the Home Office since August 2022 on the pilot to place ankle tags on, and track the GPS location of, up to 600 migrants who arrived in the UK and were on immigration bail. This came after concerns about the scheme were raised by the charity Privacy International.
The purpose of the pilot was to test whether electronic monitoring is an effective way to maintain regular contact with asylum claimants, while reducing the risk of absconding and to establish whether it is an effective alternative to detention.
The ICO found that the Home Office failed to sufficiently assess how this intrudes on people’s privacy, and that it failed to assess the potential impact on people who may already be in a vulnerable position due to their immigration status. That meant it did not sufficiently consider what measures should be put in place to mitigate against those risks, such as providing clear information about why people’s location data was being collected and how it would be used.
Update policies and guidance
In response, the enforcement notice orders the department to update its internal policies, access guidance and privacy information in relation to the data retained from the pilot scheme.
The formal warning states that any future processing by the Home Office on the same basis will be in breach of data protection law and will attract enforcement action.
John Edwards, UK information commissioner, said: “Having access to a person’s 24/7 movements is highly intrusive, as it is likely to reveal a lot of information about them, including the potential to infer sensitive information such as their religion, sexuality, or health status. Lack of clarity on how this information will be used can also inadvertently inhibit people’s movements and freedom to take part in day-to-day activities.
“If such information were to be mishandled or misinterpreted, it could potentially have harmful consequences to people and their future. The Home Office did not assess those risks sufficiently, which means the pilot scheme was not legally compliant.
"We recognise the Home Office’s crucial work to keep the UK safe, and it’s for them to decide on what measures are necessary to do so. But I'm sending a clear warning to the Home Office that they cannot take the same approach in the future. It is our duty to uphold people’s information rights, regardless of their circumstances."
No sufficient explanation
The ICO said that throughout its enquiries the Home Office was unable to explain sufficiently why it was necessary or proportionate to collect, access and use people’s information via electronic monitoring for the pilot’s purpose. This included failing to provide evidence that it had considered less intrusive methods.
It added that such intrusive processing should be accompanied by robust guidance and procedures to ensure it is applied consistently and in a privacy preserving way. The Home Office guidance failed to provide sufficient direction to staff on when it would be necessary and proportionate to electronically monitor people as an immigration bail condition.
The Home Office also failed to provide clear and easily accessible information to the people being tagged about what personal information is being collected, how it will be used, how long it will be kept for, and who it will be shared with. The privacy information was not set out clearly in one place, was inconsistent and there were information gaps.
Respect rights
Edwards added: “It’s crucial that the UK has appropriate checks and balances in place to ensure people’s information rights are respected and safeguarded. This is even more important for those who might not even be aware that they have those rights.
“This action is a warning to any organisation planning to monitor people electronically – you must be able to prove the necessity and proportionality of tracking people’s movements, taking into consideration people’s vulnerabilities and how such processing could put them at risk of further harm. This must be done from the outset, not as an afterthought.
“I welcome the Home Office’s commitment to improve the privacy information for those whose personal information is still being held and to make improvements on their approach to data protection impact assessments.”
Although the pilot scheme ended in December 2023, the Home Office will continue to be able to access the personal information gathered throughout the pilot until all the data has been deleted or anonymised. This means there is still potential for the information collected to be accessed and used, not just by the Home Office but other third party organisations.
