Personal data privacy risks

#19 —

Human Rights (Joint Committee)

Recommendation: Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended accordingly. …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#14 —

Human Rights (Joint Committee)

Recommendation: Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access requested …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Accepted

#9 —

Human Rights (Joint Committee)

Recommendation: We are concerned that clause 35(7) and (8), deeming transfer of personal data to third countries and international organisations to be necessary for important reasons of public interest, inappropriately disapplies the normal safeguards in data protection legislation when data is …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Not Accepted

#162 —

Human Rights (Joint Committee)

Recommendation: recommendation Given the severe infringement on the right to privacy posed by the imposition of electronic monitoring, the threshold test for electronic monitoring should be one of “necessity and proportionality”, not whether it is “appropriate”. Clause 52 should be amended …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Not Accepted

#161 —

Human Rights (Joint Committee)

Recommendation: The power to impose electronic monitoring engages Article 8, which requires that any interferences with the right to private and family life are in accordance with the law, in pursuit of a legitimate aim and necessary and proportionate to that …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Under Consideration

#160 —

Human Rights (Joint Committee)

Recommendation: Open Rights Group note that “the Bill’s provisions offer limited procedural safeguards (for instance, reliance on “reasonable grounds” rather than rigorous independent judicial oversight). Such a low threshold can lead to overly broad applications of state power.”201 Migrant Help states …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Under Consideration

#159 —

Human Rights (Joint Committee)

Recommendation: Clause 52 provides the courts with the power to impose electronic monitoring200 as part of SCPO requirements. Electronic monitoring can be imposed where there are “reasonable grounds to believe that the [overall] order would protect the public” and that this …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Under Consideration

#157 —

Human Rights (Joint Committee)

Recommendation: The Bill provides power to impose electronic monitoring as a requirement of a Serious Crime Prevention Order (SCPO). It also provides for the power to impose interim SCPOs whilst an application for a final order is pending. SCPOs, introduced by …

Gov response: It is important to clarify that the imposition of electronic monitoring as part of a Serious Crime Prevention Order (SCPO) is not intended as a standalone punitive measure, rather as a means of monitoring compliance …

Under Consideration

#149 —

Human Rights (Joint Committee)

Recommendation: recommendation The requirements in clause 43 for imposing conditions such as electronic monitoring, geographical exclusions, and curfews, should be set out clearly on the face of the Bill and adequately circumscribed. In order to reflect the Government’s intentions as stated …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Under Consideration

#143 —

Human Rights (Joint Committee)

Recommendation: The current restrictions, set out in section 3(1)(c) of the Immigration Act 1971, permit restrictions to be placed on individuals such as restrictions on the right to work and study, requirements to report to immigration officers, and residency requirements. The …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Under Consideration

#142 —

Human Rights (Joint Committee)

Recommendation: At Committee stage in the Commons, the Government added clause 43. This introduces an extension of the existing conditions that may be applied to any grant of limited leave to enter or remain in the UK under section 3(1) (c) …

Gov response: The Home Office will always seek to deport or remove those foreign nationals who pose a threat to the UK or whose behaviour is such that they do not qualify for international protection. Where the …

Under Consideration

#134 —

Human Rights (Joint Committee)

Recommendation: This clause also engages Article 8 because it gives powers to obtain biometrics and search documents. An interference with this right must be in accordance with the law and proportionate to the pursuit of a legitimate aim. It is the …

Gov response: Clause 41 of the Bill clarifies the existing statutory powers of detention where the Home Office is considering whether deportation is conducive to the public good and consequential amendments to existing powers to take biometrics …

Under Consideration

#128 —

Human Rights (Joint Committee)

Recommendation: The clause also amends section 141 of the Immigration Act 1999 (fingerprinting) and regulation 2 of the Immigration (Collection, Use and Retention of Biometric Information and Related Amendments) Regulations 2021 (photographs) to clarify that fingerprints and photographs can be taken …

Gov response: Clause 41 of the Bill clarifies the existing statutory powers of detention where the Home Office is considering whether deportation is conducive to the public good and consequential amendments to existing powers to take biometrics …

Under Consideration

#126 —

Human Rights (Joint Committee)

Recommendation: recommendation Section 62 IMA should be amended, as recommended by our predecessor Committee, to make clear that the credibility of a claimant who has provided a reasonable excuse for their failure to provide a password or other methods of access …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Accepted

#125 —

Human Rights (Joint Committee)

Recommendation: In respect of this provision, the previous JCHR concluded in its report on the Illegal Migration Bill: “we remain concerned that an asylum or human rights claimant’s credibility should not be damaged by conduct that may be explained by something …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Accepted

#124 —

Human Rights (Joint Committee)

Recommendation: The Bill does not repeal section 62 IMA. This means that if a person making a human rights or asylum claim does not allow the Home Office to look at everything (including private information) on their phone, then the Home …

Gov response: Section 62 of the IMA 2023 expands upon the existing provisions in section 8 of the Asylum and Immigration (Treatment of Claimants, etc.) Act 2004. This provision sets out the circumstances in which a decision …

Accepted

#89 —

Human Rights (Joint Committee)

Recommendation: conclusion We are concerned that clause 35(7) and (8), deeming transfer of personal data to third countries and international organisations to be necessary for important reasons of public interest, inappropriately disapplies the normal safeguards in data protection legislation when data …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Not Accepted

#88 —

Human Rights (Joint Committee)

Recommendation: ILPA notes that EU law specifically prohibits the transfer of personal data to a third country or international organisation for law enforcement purposes, “if there is a real risk that, as a result of such a transfer, the data subject …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Under Consideration

#87 —

Human Rights (Joint Committee)

Recommendation: With regard to children, Open Rights Group notes that collecting biometric data from children over 16 without consent could violate child protection standards: “According to the guidance of the Information Commissioner’s Office (ICO) on processing sensitive personal data under the …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Accepted

#86 —

Human Rights (Joint Committee)

Recommendation: However, clause 35(7) provides that if the information is used to identify a person for the purposes of facilitating their departure from another state or territory, and the information is transferred to a third country or international organisation for that …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Accepted

#84 —

Human Rights (Joint Committee)

Recommendation: For collection and retention of biometric information to comply with Article 8 ECHR, the way the information will be used must be reasonably foreseeable, and the collection and retention must pursue a legitimate aim in a proportionate manner. There must …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Accepted

#83 —

Human Rights (Joint Committee)

Recommendation: Clause 35 provides that the information must then be passed to the Secretary of State, who can keep and use it for purposes relating to immigration, nationality, law enforcement or national security. The information cannot be kept for longer than …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Under Consideration

#82 —

Human Rights (Joint Committee)

Recommendation: Under clause 34, an authorised person119 may take biometric information from a person (including children) if the Government is in the process of facilitating their exit from a third country and they would need leave to enter the UK. This …

Gov response: We thank the Committee for its consideration of Clause 35 and note the concern about the transfer of personal data. The Bill does not provide a broad-brush approach or disapplication of data protection safeguards. Instead, …

Accepted

#81 —

Human Rights (Joint Committee)

Recommendation: conclusion We are concerned that there is a risk that the new powers of search, seizure and retention, in practice, may lead to a blanket policy to search, and possibly seize and retain, items such as mobile phones from asylum …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Not Accepted

#78 —

Human Rights (Joint Committee)

Recommendation: Migrant Rights Network also notes the risk of disproportionality: “[m] obile phone seizures have also had limited success in other countries where the practice is commonplace, like Germany: 73% of data extracted from asylum seekers’ phones is unusable. As a …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#77 —

Human Rights (Joint Committee)

Recommendation: Open Rights Group notes: “[o]ur concern is that these clauses risk invasive digital searches. The broad definition of “relevant articles” and the broad authority to search persons for electronic devices, especially the power to access, copy, and use data stored …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#76 —

Human Rights (Joint Committee)

Recommendation: Whilst the powers of search and seizure in these clauses are likely to be ‘in accordance with the law’ and in pursuit of the legitimate aim of crime prevention, there are questions as to necessity and proportionality. Liberty argues that …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#74 —

Human Rights (Joint Committee)

Recommendation: The European Court has held that legislation applying to search and seizure must afford adequate and effective safeguards against abuse and arbitrariness.112 Further, section 37 of the Data Protection Act 2018 requires that personal data processed for law enforcement purposes …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#73 —

Human Rights (Joint Committee)

Recommendation: The new powers would interfere with rights under Article 8 and Article 1 of Protocol 1, which are incorporated into domestic law by the Human Rights Act, because they would allow access to private information (stored electronically) and would interfere …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Not Accepted

#72 —

Human Rights (Joint Committee)

Recommendation: The new powers appear to be a response to a decision of the High Court in 2022, which held that the Home Secretary had acted unlawfully by having an unpublished blanket policy to search for, and seize, mobile phones from …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#71 —

Human Rights (Joint Committee)

Recommendation: Searches of a person may involve the search of the person’s mouth and may require the removal of outer clothing.107 Reasonable force may be used.108 The Bill also allows officers to retain data for as long as they deem “necessary”,109 …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#69 —

Human Rights (Joint Committee)

Recommendation: Clauses 19–26 introduce new search, seizure and retention powers in relation to electronic devices. The Government’s objective is to allow for the recovery of information from migrants arriving irregularly that may relate to the offence of assisting unlawful migration or …

Gov response: The powers of search and seizure, at clauses 19–26, will not be applied indiscriminately, nor on a blanket basis. The powers will only be exercised where there are reasonable grounds to suspect that an electronic …

Accepted

#20 —

Transport Committee

Recommendation: We recommend that the government consult within the next 12 months on introducing mandatory in-vehicle CCTV, with a view to including this requirement within national standards if it is sufficiently supported by evidence. The consultation should also seek views on …

Response Pending

#50 —

Science, Innovation and Technology Committee

Recommendation: It would be irresponsible to roll out a digital ID built on the UK’s current digital infrastructure. The public sector holds citizens’ data on trust, and should therefore hold itself to a higher standard. The operational and security problems relating …

Response Pending

#47 —

Science, Innovation and Technology Committee

Recommendation: The government should in its response to this report set out what contingencies it has in place to safeguard citizens’ data should the United States trigger data access provisions in the CLOUD Act 2018, and share any impact assessments that …

Response Pending

#30 —

Science, Innovation and Technology Committee

Recommendation: In its response to this report the government should confirm the exact nature of Palantir’s access to identifiable and non-identifiable patient data, on what statutory basis this was authorised, when, and by whom; and whether the Information Commissioner was consulted. …

Response Pending

#15 —

Science, Innovation and Technology Committee

Recommendation: The findings of the internal review examining events at the UK Biobank should be published in full. In its response to this report the government and UKRI should set out the technical protections that will be put in place at …

Response Pending

#14 —

Science, Innovation and Technology Committee

Recommendation: In its response to this report, the government should set out how it intends to measure departmental and public body efforts to bring about difficult but necessary cultural changes in relation to data protection. It should name the departments and …

Response Pending

#12 —

Science, Innovation and Technology Committee

Recommendation: UK Biobank is in receipt of public funds, and so the government should help it to ensure that failings are addressed as a matter of urgency. This incident underlines that contractual arrangements to protect citizens’ data must also be accompanied …

Response Pending

#11 —

Science, Innovation and Technology Committee

Recommendation: The advertisement of UK Biobank datasets on a Chinese e-commerce platform points to a particularly egregious example of inadequate data hygiene. The seriousness of the breach was compounded by a response that showed a lack of appreciation of the trust …

Response Pending

#9 —

Science, Innovation and Technology Committee

Recommendation: It is a fundamental duty of government, public sector bodies and bodies in receipt of public funds to keep safe the data they hold on citizens. This duty has not been consistently upheld in the UK for some time. An …

Response Pending

#2 — Recommend a trial of a centralised Secure Data Environment and simplify ethical governance

Science, Innovation and Technology Committee

Recommendation: Should our successor Committee wish to explore the reform of the UK health data strategy, we recommend it considers: • Investigating the replication of the academic model of open and competitive funding to solve problems and develop Privacy Enhancing technologies …

No Published Response

#15 — HMRC lags in secure digital file sharing; plans secure messaging via app and tax accounts.

Public Accounts Committee

Recommendation: HMRC said it uses email sparingly due to security concerns.42 Several organisations representing taxpayers and their agents wrote to us to highlight the need for a secure digital way to share files and correspondence with HMRC so that communication by …

Gov response: The government agrees with the Committee’s recommendation. Target implementation date: March 2028 4.2 HMRC is considering options to enhance and improve its current services to give taxpayers and intermediaries secure digital channels that they expect, …

Not Addressed

#4 — Prioritise introducing systems for customers to submit files and send secure digital messages.

Public Accounts Committee

Recommendation: HMRC does not provide an efficient means for taxpayers to communicate digitally with HMRC. In 2022–23, HMRC received 22 million items of correspondence, including physical post and forms and interactive forms. Approximately 70% of this comes in through the post. …

Gov response: The government agrees with the Committee’s recommendation. taxpayers and intermediaries secure digital channels that they expect, the ability to communicating and exchanging documents, driving better customer service and increasing yield.

Accepted

#28 — Require tech companies to cleanse datasets of NCII and source data responsibly.

Women and Equalities Committee

Recommendation: The private sector has innovated to create AI technology. It does not need to wait for legislation to catch up in order to safeguard individuals from harmful AI-generated content. As a starting point tech companies involved in AI content creation …

Gov response: Government response: Reject There are already a range of regulatory requirements that apply to relevant services. Generative AI services which have functionalities that bring them into scope of the Online Safety Act, e.g. meeting the …

No Published Response

#59 — Conduct a review of copyright and GDPR to prevent unlicensed data use for AI.

Culture, Media and Sport Committee

Recommendation: Within the next six months the Government should also conduct a review of the Copyright, Designs and Patents Act 1988 and the UK’s GDPR framework to consider whether further legislation is needed to prevent unlicensed use of data for AI …

Gov response: The government keeps legal frameworks under review, including those relating to copyright and related rights, and data protection. The Data (Use and Access) Act 2025 contains a number of updates to the data protection framework. …

Not Addressed

#54 — Opt-out data mining regime risks UK’s creative industries and copyright reputation

Culture, Media and Sport Committee

Recommendation: Getting the balance between AI development and copyright wrong will undermine the growth of our film and HETV sectors, and wider creative industries. Proceeding with an ‘opt-out’ regime stands to damage the UK’s reputation among inward investors for our previously …

Gov response: The government is currently considering the 11,500 responses to its consultation and will provide its response in the coming months. The government recognises the need for this to be done properly and carefully in a …

Not Addressed

#27 — Improve transparency of FCDO data collected on contractors, ensuring clear IATI reporting.

International Development Committee

Recommendation: The FCDO must make every effort to improve the transparency of the data it collects on its engagement with contractors and operating partners. The information that is required of organisations to report through IATI must be published in a way …

Gov response: Agree. The FCDO is committed to ensuring that data is published in a clear, user-friendly, and complete manner. The FCDO recognises the importance of IATI data not just in its availability but also its accessibility …

Accepted

#26 — Require all FCDO contracts with private contractors to adhere to IATI standards.

International Development Committee

Recommendation: It is essential that the FCDO requires all of its contracts with private contractors to adhere to the International Aid Transparency Initiative, not just most, to ensure that all implementers of UK ODA are held to the same transparency and …

Gov response: Agree. The published organisation and activity data of the FCDO’s implementing partners is incomplete and more can be done to improve the completeness of the UK’s International Aid Transparency Initiative (IATI) publishing. While some information …

Partially Accepted

#25 — Published data on FCDO's implementing partners remains incomplete and obscure.

International Development Committee

Recommendation: The FCDO’s use of private contractors is not inherently poor value for money. However, the published organisation and activity data of all implementing partners, including private contractors, is often incomplete and obscure. This exposes every pound spent to a higher …

Gov response: Agree. The published organisation and activity data of the FCDO’s implementing partners is incomplete and more can be done to improve the completeness of the UK’s International Aid Transparency Initiative (IATI) publishing. While some information …

Accepted