HM (R on the application of) v SECRETARY OF STATE FOR THE HOME DEPARTMENT

This judicial review concerned the lawfulness of a Home Office practice to search, seize, retain and in some cases extract data from migrants' mobile telephones following small-boat crossings. The Secretary of State conceded that a blanket, unpublished policy of seizing mobile phones was operated between April and November 2020 and that aspects of the retention, extraction and PIN-demand practices were unlawful and incompatible with the Data Protection Act 2018 and Article 8 of the ECHR.

The court held that the searches and seizures in these cases were not carried out under the statutory personal-search power in paragraph 25B of Schedule 2 to the Immigration Act 1971 because officers had not applied their minds to the statutory preconditions for that power; instead the searches were effected as part of the blanket policy. The court concluded that section 48 of the Immigration Act 2016 is, on its proper construction and by analogy with section 19 of PACE 1984, a power tied to premises and does not authorise a general power to search persons for and seize their phones. Although section 48(7) and (9) permit removal of devices for forensic examination in appropriate cases, those statutory features did not validate the blanket practice. The PIN demand practice was unlawful because it suggested criminal sanctions that did not exist and could not be enforced under section 49 of RIPA 2000 without judicial authorisation.

The court accepted the Secretary of State's concessions and found breaches of Article 8 and data protection obligations; remedies and questions about the duty of candour and appropriate orders were reserved for a further hearing.

The claimants were migrants who arrived in the United Kingdom in small boats and whose mobile telephones were seized, retained and in some cases subject to data extraction by Home Office officers at Dover Tug Haven. Judicial review was sought challenging the lawfulness of the searches, the seizure and retention of phones, the extraction and further processing of data, the demand for phone PINs, and the legality of the policies underpinning those measures.

Parties and procedure

• The claimants brought parallel judicial review claims; the Secretary of State defended and Privacy International intervened. The hearing took place before the Divisional Court (Edis LJ and Lane J) in January 2022 with further written submissions in February 2022.

Relief sought

The claimants sought declarations and other relief that the searches, seizures, retention and extraction of data were unlawful and incompatible with domestic statutes and the ECHR, and that the PIN-demand practice and the unpublished blanket policies were unlawful.

Issues framed

• Whether searches were lawful under paragraph 25B of Schedule 2 to the Immigration Act 1971.
• Whether section 48 of the Immigration Act 2016 authorises seizure of items found on a person or is confined to premises.
• Whether seizure and retention were lawful when used to "seize and sift" devices for intelligence gathering absent express statutory authorisation.
• The lawfulness of the PIN-demand practice and of unpublished blanket policies under ECHR Article 8 and the Data Protection Act 2018.

Court's reasoning and findings

• The Secretary of State made significant concessions that the blanket seizure policy was unlawful because it was both general (blanket) and unpublished; that PIN demands were unlawful; that certain retention and extraction provisions and Data Protection Impact Assessments were defective.
• The court found on the evidence that during the period of the blanket policy officers did not conduct searches and seizures under paragraph 25B(2) or (3)(a) because they did not apply the required statutory preconditions; rather they acted pursuant to the blanket practice and were therefore unable to rely on paragraph 25B to justify those actions.
• On statutory construction, section 48 of the Immigration Act 2016 was interpreted in the light of its close drafting relationship with section 19 of PACE 1984 and was held to be principally a power tied to being "lawfully on premises". The court concluded that, absent clear words to the contrary, section 48 should not be read as authorising a general non-consensual search of the person or a free-standing power to seize phones found on a person.
• The court considered the treatment of "seize and sift" powers, acknowledging that sections 50 and 51 of the Criminal Justice and Police Act 2001 supply an established regime for removal and off-site sifting in appropriate cases, and that section 48(7) and (9) suggest Parliament contemplated forensic examination off-site. Nevertheless, those features did not validate the blanket, unpublished policy operated in 2020.
• Because the unlawful blanket and unpublished nature of the policy meant there was no lawful basis for the processing of data, and because officers demanded PINs without lawful authority, the seizure, retention and extraction practices breached Article 8 and data protection obligations. The Secretary of State's self-referral to the Information Commissioner was noted and the court declined to resolve remaining detailed data-protection issues, leaving them for the ICO or a later hearing if necessary.

Disposition

The court held that the claims succeeded on the grounds indicated, that the seizures and related conduct in the period were unlawful and contrary to Article 8 and data protection law, and directed a further hearing to determine remedies and to consider breaches of the duty of candour.

The claimants' judicial review claims succeed. The Secretary of State had operated a blanket, unpublished policy of seizing migrants' mobile phones which was unlawful; searches were not carried out under paragraph 25B of Schedule 2 to the Immigration Act 1971; section 48 of the Immigration Act 2016 was construed as a premises-tied seizure power and does not authorise a general personal search and seizure of phones; the PIN-demand practice and certain retention and extraction practices breached Article 8 ECHR and data protection law. Remedies and the duty of candour issues are to be determined at a further hearing.