Information Commissioner's Office says pilot scheme to electronically tag migrants was not lawful
The Information Commissioner's Office (ICO) has said today that the Home Office breached UK data protection law over a pilot scheme to electronically monitor migrants.
Image credit: WikipediaUnder the pilot scheme that ended in December 2023, up to 600 migrants who arrived in the UK and were on immigration bail were required to wear GPS ankle tags to monitor their whereabouts. The pilot scheme sought to establish whether GPS tagging was an effective way to maintain regular contact with asylum claimants while reducing the risk of absconding.
The ICO found the pilot scheme was not legally compliant. The Home Office failed to sufficiently assess the privacy intrusion of the tags' continuous collection of personal information and it failed to assess the potential impact on people who may already be in a vulnerable position due to their immigration status. In addition, the Home Office did not sufficiently consider what measures should be put in place to mitigate against the risks, such as providing clear information about why people's location data was being collected and how it would be used.
According to the ICO, the Home Office was not able to adequately explain why it was necessary or proportionate to collect, access and use people's information for the purpose of the pilot scheme. Guidance to Home Office staff also failed to provide sufficient direction on when it would be necessary and proportionate to electronically monitor people as an immigration bail condition.
Following its findings, the ICO issued an Enforcement Notice and a formal warning against the Home Office. The warning states that any future processing by the Home Office on the same basis will be in breach of data protection law and will attract enforcement action.
John Edwards, the UK Information Commissioner, said: "This action is a warning to any organisation planning to monitor people electronically – you must be able to prove the necessity and proportionality of tracking people's movements, taking into consideration people's vulnerabilities and how such processing could put them at risk of further harm. This must be done from the outset, not as an afterthought."
Privacy International noted that an Enforcement Notice is a binding decision that declares previous or existing data processing to be unlawful, and it is the strongest form of enforcement available to the ICO under data protection law.
In August 2022, Privacy International filed a complaint against the Home Office's GPS tagging policy, arguing there was widespread and significant breaches of privacy and data protection law. Today, Privacy International welcomed the ICO's "significant and forceful decision" finding the pilot scheme's tagging to be unlawful.
In response the ICO findings, Privacy International said: "These findings are significant as they go to the systemic features of the GPS tagging policy. Necessity and proportionality are key principles that run throughout data protection law, and when invoked are telling of the problematic nature of the scheme as a whole, instead of discrete and specific data issues or breaches. The failure to assess the impact on people and risks to their fundamental rights is similarly systemic."
Privacy International added that the ICO's decision was a "significant, systemic and unprecedented blow" to the Home Office's GPS tagging of migrants, which has been a key part of the UK's 'hostile environment' immigration policy.
While Privacy International noted that the ICO's decision was not the end and the Home Office will continue to tag migrants, it added that the GPS tagging policy as a whole is facing multiple challenges in the courts. Judgements are currently awaited in two court challenges.
The Home Office said it was disappointed by the ICO's decision.
The Independent quoted a Home Office spokesperson as saying: "We are disappointed that the ICO has issued this notice and whilst acknowledging improvements to documentation could be made, we reject the claim that the privacy risks of the scheme weren't sufficiently addressed. The pilot was designed to help us maintain contact with selected asylum claimants, deter absconding and progress asylum claims more effectively. We will now carefully consider the ICO's findings and respond in due course."