Personal data privacy risks

#19 —

Human Rights (Joint Committee)

Recommendation: Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended accordingly. …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#30 —

Defence Committee

Recommendation: The obligations examined in this report arose from the UK’s long involvement in Afghanistan, the commitments made to Afghans who supported the UK mission, and the additional risks created by the data breach. The government and local partners have brought …

Response Pending

#20 —

Defence Committee

Recommendation: The UK’s obligations after the breach were wider than its pre-existing ARAP commitments. The government had continuing obligations to eligible Afghans to whom public commitments had been made after Op PITTING, and additional responsibilities to people placed at increased risk …

Response Pending

#16 —

Defence Committee

Recommendation: The government approached notification of affected Afghans primarily as a communications exercise rather than as a safeguarding intervention. Although the notification reached most affected individuals, it did not provide sufficiently specific, actionable or individualised information to enable people to understand …

Response Pending

#6 —

Defence Committee

Recommendation: The Afghan data-breach injunction was an exceptional measure with profound constitutional consequences. Even aside from the “superinjunction” element, it prevented public and parliamentary knowledge of a major policy response involving risk to life, substantial public expenditure and affected communities across …

Response Pending

#5 —

Defence Committee

Recommendation: Government should mandate and enforce minimum standards for skills, process, tools, controls, independent assurance and testing for datasets where compromise could plausibly risk life. The MOD should also explain who held senior official responsibility for data-protection risk in ARAP before …

Response Pending

#4 —

Defence Committee

Recommendation: Describing the breach as a systemic failure does not mean that responsibility lay nowhere. Institutional accountability requires clear lines of responsibility. Where a department takes on unfamiliar responsibilities involving life-endangering data, clear senior ownership of risk, assurance and data protection …

Response Pending

#3 —

Defence Committee

Recommendation: The breach was not simply an individual mistake, but a foreseeable systemic failure. It arose from the combination of inappropriate tools, weak operating procedures, insufficient training, poor organisational continuity, and an inadequate culture of data protection and accountability. The pressures …

Response Pending

#55 —

Justice Committee

Recommendation: Legal aid providers and clients have been insufficiently compensated for the additional work and data loss caused by the 2025 cyber- attack. The response of the Legal Aid Agency and Ministry of Justice to informing and safeguarding victims has not …

Response Pending

#21 —

Science, Innovation and Technology Committee

Recommendation: The UK’s research base is operating in an increasingly contested global environment. The risks to research security are growing but the UK’s response is insufficiently developed. Though the recent breach at UK Biobank illustrated how research collaborations can be exploited …

Response Pending

#14 —

Human Rights (Joint Committee)

Recommendation: Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access requested …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Position Not Stated

#9 —

Human Rights (Joint Committee)

Recommendation: We are concerned that clause 35(7) and (8), deeming transfer of personal data to third countries and international organisations to be necessary for important reasons of public interest, inappropriately disapplies the normal safeguards in data protection legislation when data is …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Position Not Stated

#162 —

Human Rights (Joint Committee)

Recommendation: recommendation Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#161 —

Human Rights (Joint Committee)

Recommendation: The power to impose electronic monitoring engages Article 8, which requires that any interferences with the right to private and family life are in accordance with the law, in pursuit of a legitimate aim and necessary and proportionate to that …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#160 —

Human Rights (Joint Committee)

Recommendation: Open Rights Group note that “the Bill’s provisions offer limited procedural safeguards (for instance, reliance on “reasonable grounds” rather than rigorous independent judicial oversight). Such a low threshold can lead to overly broad applications of state power.”201 Migrant Help states …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#159 —

Human Rights (Joint Committee)

Recommendation: Clause 52 provides the courts with the power to impose electronic monitoring200 as part of SCPO requirements. Electronic monitoring can be imposed where there are “reasonable grounds to believe that the [overall] order would protect the public” and that this …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#157 —

Human Rights (Joint Committee)

Recommendation: The Bill provides power to impose electronic monitoring as a requirement of a Serious Crime Prevention Order (SCPO). It also provides for the power to impose interim SCPOs whilst an application for a final order is pending. SCPOs, introduced by …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Under Consideration

#149 —

Human Rights (Joint Committee)

Recommendation: recommendation The requirements in clause 43 for imposing conditions such as electronic monitoring, geographical exclusions, and curfews, should be set out clearly on the face of the Bill and adequately circumscribed. In order to reflect the Government’s intentions as stated …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Response Not Attributed

#143 —

Human Rights (Joint Committee)

Recommendation: The current restrictions, set out in section 3(1)(c) of the Immigration Act 1971, permit restrictions to be placed on individuals such as restrictions on the right to work and study, requirements to report to immigration officers, and residency requirements. The …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Response Not Attributed

#142 —

Human Rights (Joint Committee)

Recommendation: At Committee stage in the Commons, the Government added clause 43. This introduces an extension of the existing conditions that may be applied to any grant of limited leave to enter or remain in the UK under section 3(1) (c) …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Response Not Attributed

#134 —

Human Rights (Joint Committee)

Recommendation: This clause also engages Article 8 because it gives powers to obtain biometrics and search documents. An interference with this right must be in accordance with the law and proportionate to the pursuit of a legitimate aim. It is the …

Gov response: Clause 41 of the Bill clarifies the existing statutory powers of detention where the Home Office is considering whether deportation is conducive to the public good and consequential amendments to existing powers to take biometrics …

Accepted

#128 —

Human Rights (Joint Committee)

Recommendation: The clause also amends section 141 of the Immigration Act 1999 (fingerprinting) and regulation 2 of the Immigration (Collection, Use and Retention of Biometric Information and Related Amendments) Regulations 2021 (photographs) to clarify that fingerprints and photographs can be taken …

Gov response: Clause 41 of the Bill clarifies the existing statutory powers of detention where the Home Office is considering whether deportation is conducive to the public good and consequential amendments to existing powers to take biometrics …

Under Consideration

#126 —

Human Rights (Joint Committee)

Recommendation: recommendation Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Response Not Attributed

#125 —

Human Rights (Joint Committee)

Recommendation: In respect of this provision, the previous JCHR concluded in its report on the Illegal Migration Bill: “we remain concerned that an asylum or human rights claimant’s credibility should not be damaged by conduct that may be explained by something …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Response Not Attributed

#124 —

Human Rights (Joint Committee)

Recommendation: The Bill does not repeal section 62 IMA. This means that if a person making a human rights or asylum claim does not allow the Home Office to look at everything (including private information) on their phone, then the Home …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Response Not Attributed

#89 —

Human Rights (Joint Committee)

Recommendation: conclusion We are concerned that clause 35(7) and (8), deeming transfer of personal data to third countries and international organisations to be necessary for important reasons of public interest, inappropriately disapplies the normal safeguards in data protection legislation when data …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#88 —

Human Rights (Joint Committee)

Recommendation: ILPA notes that EU law specifically prohibits the transfer of personal data to a third country or international organisation for law enforcement purposes, “if there is a real risk that, as a result of such a transfer, the data subject …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Accepted

#87 —

Human Rights (Joint Committee)

Recommendation: With regard to children, Open Rights Group notes that collecting biometric data from children over 16 without consent could violate child protection standards: “According to the guidance of the Information Commissioner’s Office (ICO) on processing sensitive personal data under the …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#86 —

Human Rights (Joint Committee)

Recommendation: However, clause 35(7) provides that if the information is used to identify a person for the purposes of facilitating their departure from another state or territory, and the information is transferred to a third country or international organisation for that …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#84 —

Human Rights (Joint Committee)

Recommendation: For collection and retention of biometric information to comply with Article 8 ECHR, the way the information will be used must be reasonably foreseeable, and the collection and retention must pursue a legitimate aim in a proportionate manner. There must …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#83 —

Human Rights (Joint Committee)

Recommendation: Clause 35 provides that the information must then be passed to the Secretary of State, who can keep and use it for purposes relating to immigration, nationality, law enforcement or national security. The information cannot be kept for longer than …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#82 —

Human Rights (Joint Committee)

Recommendation: Under clause 34, an authorised person119 may take biometric information from a person (including children) if the Government is in the process of facilitating their exit from a third country and they would need leave to enter the UK. This …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Response Not Attributed

#81 —

Human Rights (Joint Committee)

Recommendation: conclusion We are concerned that there is a risk that the new powers of search, seizure and retention, in practice, may lead to a blanket policy to search, and possibly seize and retain, items such as mobile phones from asylum …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Position Not Stated

#78 —

Human Rights (Joint Committee)

Recommendation: Migrant Rights Network also notes the risk of disproportionality: “[m] obile phone seizures have also had limited success in other countries where the practice is commonplace, like Germany: 73% of data extracted from asylum seekers’ phones is unusable. As a …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#77 —

Human Rights (Joint Committee)

Recommendation: Open Rights Group notes: “[o]ur concern is that these clauses risk invasive digital searches. The broad definition of “relevant articles” and the broad authority to search persons for electronic devices, especially the power to access, copy, and use data stored …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#76 —

Human Rights (Joint Committee)

Recommendation: Whilst the powers of search and seizure in these clauses are likely to be ‘in accordance with the law’ and in pursuit of the legitimate aim of crime prevention, there are questions as to necessity and proportionality. Liberty argues that …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#74 —

Human Rights (Joint Committee)

Recommendation: The European Court has held that legislation applying to search and seizure must afford adequate and effective safeguards against abuse and arbitrariness.112 Further, section 37 of the Data Protection Act 2018 requires that personal data processed for law enforcement purposes …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#73 —

Human Rights (Joint Committee)

Recommendation: The new powers would interfere with rights under Article 8 and Article 1 of Protocol 1, which are incorporated into domestic law by the Human Rights Act, because they would allow access to private information (stored electronically) and would interfere …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#72 —

Human Rights (Joint Committee)

Recommendation: The new powers appear to be a response to a decision of the High Court in 2022, which held that the Home Secretary had acted unlawfully by having an unpublished blanket policy to search for, and seize, mobile phones from …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#71 —

Human Rights (Joint Committee)

Recommendation: Searches of a person may involve the search of the person’s mouth and may require the removal of outer clothing.107 Reasonable force may be used.108 The Bill also allows officers to retain data for as long as they deem “necessary”,109 …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#69 —

Human Rights (Joint Committee)

Recommendation: Clauses 19–26 introduce new search, seizure and retention powers in relation to electronic devices. The Government’s objective is to allow for the recovery of information from migrants arriving irregularly that may relate to the offence of assisting unlawful migration or …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Response Not Attributed

#20 —

Transport Committee

Recommendation: We recommend that the government consult within the next 12 months on introducing mandatory in-vehicle CCTV, with a view to including this requirement within national standards if it is sufficiently supported by evidence. The consultation should also seek views on …

Response Pending

#50 —

Science, Innovation and Technology Committee

Recommendation: It would be irresponsible to roll out a digital ID built on the UK’s current digital infrastructure. The public sector holds citizens’ data on trust, and should therefore hold itself to a higher standard. The operational and security problems relating …

Response Pending

#47 —

Science, Innovation and Technology Committee

Recommendation: The government should in its response to this report set out what contingencies it has in place to safeguard citizens’ data should the United States trigger data access provisions in the CLOUD Act 2018, and share any impact assessments that …

Response Pending

#30 —

Science, Innovation and Technology Committee

Recommendation: In its response to this report the government should confirm the exact nature of Palantir’s access to identifiable and non-identifiable patient data, on what statutory basis this was authorised, when, and by whom; and whether the Information Commissioner was consulted. …

Response Pending

#15 —

Science, Innovation and Technology Committee

Recommendation: The findings of the internal review examining events at the UK Biobank should be published in full. In its response to this report the government and UKRI should set out the technical protections that will be put in place at …

Response Pending

#14 —

Science, Innovation and Technology Committee

Recommendation: In its response to this report, the government should set out how it intends to measure departmental and public body efforts to bring about difficult but necessary cultural changes in relation to data protection. It should name the departments and …

Response Pending

#12 —

Science, Innovation and Technology Committee

Recommendation: UK Biobank is in receipt of public funds, and so the government should help it to ensure that failings are addressed as a matter of urgency. This incident underlines that contractual arrangements to protect citizens’ data must also be accompanied …

Response Pending

#11 —

Science, Innovation and Technology Committee

Recommendation: The advertisement of UK Biobank datasets on a Chinese e-commerce platform points to a particularly egregious example of inadequate data hygiene. The seriousness of the breach was compounded by a response that showed a lack of appreciation of the trust …

Response Pending

#9 —

Science, Innovation and Technology Committee

Recommendation: It is a fundamental duty of government, public sector bodies and bodies in receipt of public funds to keep safe the data they hold on citizens. This duty has not been consistently upheld in the UK for some time. An …

Response Pending