On March 1, 2024, the Information Commissioner's Office (ICO) announced that it had issued an enforcement notice and a warning to the Home Office for failing to sufficiently assess the privacy risks posed by the electronic monitoring of people arriving in the UK via unauthorized means.

Background to the decision

The ICO stated that in August 2022, it began an assessment of a scheme by the Home Office to place ankle tags on and track the GPS location of, up to 600 migrants who arrived in the UK and were on immigration bail, after concerns about the scheme were raised by Privacy International.

Findings of the ICO

Following an investigation, the ICO found that the Home Office failed to:

• assess the privacy intrusion of the continuous collection of people's location information;
• assess the potential impact on people who may already be in a vulnerable position due to their immigration status, including the conditions of their journeys to the UK or English not being their first language;
• consider measures that should be put in place to mitigate risks, such as providing clear and easily accessible information on what personal information is being collected, how it will be used, how long it will be kept for, and who it will be shared with;
• explain why it was necessary or proportionate to collect, access, and use people's information via electronic monitoring for the pilot's purpose, including failing to prove that it had considered less intrusive methods; and
• provide sufficient direction to staff on when it would be necessary and proportionate to electronically monitor people as an immigration bail condition.

Outcomes

In light of the above, the ICO issued an enforcement notice to the Home Office requiring it to update its internal policies, access guidance, and privacy information in relation to the data retained from the pilot scheme. The ICO also issued a formal warning stating that any future processing by the Home Office on the same basis will be in breach of data protection law and will attract enforcement action.

You can read the press release here, the enforcement notice here, and the warning here.