Citation, commencement and extent

1. —(1) These Regulations may be cited as the Data Protection Act 2018 (Amendment of Schedule 2 Exemptions) Regulations 2024.

(2) These Regulations come into force on—

(a) 8th March 2024, or

(b) if later, the day after the day on which they are made.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

Amendment of paragraph 4 of Schedule 2 to the Data Protection Act 2018

2. —(1)Paragraph 4 of Schedule 2 to the Data Protection Act 2018( 4 ) (immigration) is amended as follows.

(2) In sub-paragraph (1), for “UK GDPR provisions listed in sub-paragraph (2)” substitute “relevant UK GDPR provisions” .

(3) Omit sub-paragraphs (1A) and (1B).

(4) In sub-paragraph (1C)—

(a) omit “additional”;

(b) for “this paragraph” substitute “sub-paragraph (1)” .

(5) In sub-paragraph (2), for “The UK GDPR provisions referred to in sub-paragraphs (1) and (1B)” substitute “In sub-paragraph (1) and paragraph 4A, the “relevant UK GDPR provisions”” .

Substitution of new paragraphs 4A and 4B of Schedule 2 to the Data Protection Act 2018

3. For paragraphs 4A and 4B( 5 ) of Schedule 2 to the Data Protection Act 2018, and the italic headings above those paragraphs, substitute—

“ Immigration: safeguards: immigration exemption decisions

4A. —(1) A decision under paragraph 4(1) as to whether, and the extent to which, the application of the relevant UK GDPR provisions would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) (referred to in this paragraph as “ an immigration exemption decision ”) must be made in accordance with this paragraph.

(2) An immigration exemption decision must be made—

(a) on a case by case basis,

(b) separately in respect of each of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) which relates to the data subject, and

(c) afresh on each occasion on which the Secretary of State considers disapplying or restricting the application of any of the relevant UK GDPR provisions mentioned in paragraph 4(2)(a) to (f) in relation to the data subject.

(3) When making an immigration exemption decision, the Secretary of State must take into account all the circumstances of the case, including at least the following—

(a) any potential vulnerability of the data subject that is relevant to the decision,

(b) all the rights and freedoms of the data subject including the data subject’s Convention rights, and

(c) any relevant duties or obligations of the United Kingdom, the Secretary of State or any other person, including—

(i) the United Kingdom’s obligations under the Refugee Convention and the Trafficking Convention,

(ii) any duty under section 55 of the Borders, Citizenship and Immigration Act 2009 ( 6 ) (duty regarding the welfare of children), and

(iii) the need to ensure compliance with the UK GDPR.

(4) A decision that the application of a particular relevant UK GDPR provision mentioned in paragraph 4(2)(a) to (f) (or that provision in combination with the provision mentioned in paragraph 4(2)(g), so far as it applies) would be likely to prejudice any of the matters mentioned in paragraph 4(1)(a) and (b) may be made only if—

(a) the application of that provision or those provisions would give rise to a substantial risk of prejudice to any of the matters mentioned in paragraph 4(1)(a) and (b),

(b) that risk outweighs the risk of prejudice to the interests of the data subject concerned that would arise if the exemption in paragraph 4(1) were to apply in relation to that provision or those provisions, and

(c) the application of the exemption in relation to that provision or those provisions is necessary and proportionate to the risks in the particular case.

(5) In this paragraph—

“ Convention rights ” has the same meaning as in the Human Rights Act 1998 ( 7 ) (see section 1(1) of that Act);

“ the Refugee Convention ” means the Convention relating to the Status of Refugees, done at Geneva on 28 July 1951, and its Protocol ( 8 ) ;

“ the Trafficking Convention ” means the Council of Europe Convention on Action against Trafficking in Human Beings, done at Warsaw on 16 May 2005 ( 9 ) .

Immigration: safeguard: record of decision that exemption applies

4B. —(1) Where the Secretary of State makes a decision mentioned in paragraph 4A(4), the Secretary of State must keep a record of it and the reasons for it.

(2) Where sub-paragraph (1) applies, the Secretary of State must also inform the data subject of the decision unless, in the particular circumstances of the case, the Secretary of State considers that doing so may be prejudicial to any of the matters mentioned in paragraph 4(1)(a) and (b). ” .