GPS tagging of migrants found unlawful by UK data protection authority

On 1 March 2024, the UK’s data protection authority (ICO) found that the UK government’s GPS tagging of migrants arriving to the UK by “illegal” routes was unlawful. This decision is a result of EDRi member Privacy International’s (PI) complaint filed in August 2022, alleging widespread and significant breaches of privacy and data protection law.

Following an investigation into this complaint, the ICO has issued an Enforcement Notice and a formal warning against the UK Home Office, which

1. Declares unlawful the Home Office’s pilot of GPS tagging all asylum seekers arriving to the UK by “unnecessary and dangerous routes”,
2. Requires the Home Office not to replicate these data protection failures in the future.

Background to PI’s complaint: GPS tagging of migrants since 2021

The UK Home office has been GPS tagging migrants released on immigration bail since January 2021, subjecting them to 24/7 surveillance that accumulates vast amounts of highly sensitive, sometimes intimate, data. The number of migrants tagged increased exponentially since the initial roll-out, from roughly 300 in August 2021 to 4,360 in December 2023. June 2022 to June 2023 alone saw an 86% increase in the number of tagged individuals.

GPS tagging can be imposed as one of the conditions of granting immigration bail, amongst others such as restrictions on individuals’ occupation, curfews or movement restrictions. Anyone subject to immigration control, including asylum seekers in the course of their asylum claim or other proceedings, can be subject to GPS tagging. In addition, since August 2021 the Home Office has a “mandatory duty” to tag anyone potentially facing deportation or subject to a deportation order (under Schedule 10 of the Immigration Act 2016).

In June 2022, the Home Office expanded GPS tagging through a 12-month “Expansion Pilot” whereby “all asylum claimants who arrive in the UK via unnecessary and dangerous routes” could be tagged. The Pilot was renewed for a further 6 months to 15 December 2023, as the data collected during the first 12 months “did not provide sufficient evidence”.

Systemic failures to assess the impact of GPS tagging

The ICO found the Expansion Pilot was unlawful, for it failed to comply with data protection law in a number of ways:

• The Home Office failed to adequately assess:
  • the privacy intrusion of GPS tracking, which is a highly intrusive type of processing and requires a strong justification;
  • the impact on people in vulnerable positions, and therefore did not mitigate the risks to them;
  • the necessity and proportionality of 24/7 location tracking, “taking into consideration people’s vulnerabilities and how such processing could put them at risk of further harm”; and
  • the impact of GPS tagging on individuals and on their fundamental rights and freedoms, and in particular did not take into account that relevant data subjects might be in vulnerable positions.
• The data processing involved in GPS tagging was of such a particularly intrusive nature that it should have been accompanied by robust guidance and procedures – existing ones were insufficient.
• Data subjects were not sufficiently informed of the extent of processing of their personal data, in light again of its particularly intrusive nature.

These findings are significant as they go to the systemic features of the GPS tagging policy. Necessity and proportionality are key principles that run throughout data protection law, and when invoked, they are telling of the problematic nature of the scheme as a whole, instead of discrete and specific data issues or breaches. The failure to assess the impact on people and risks to their fundamental rights is similarly systemic.

Implications of the decision

This is a significant, systemic and unprecedented blow to the Home Office’s GPS tagging of migrants, which has been a key part of the UK’s “hostile environment” policy. By putting up obstacles for migrants to access basic rights and goods such as work, public services and even bank accounts, the UK aimed to create a hostile environment for migrants, thereby deterring entry and encouraging “voluntary” departures.

Throughout this policy, a running thread seemed to emerge: migrants would be undeserving of the same human rights and protections as British citizens. This became evident in the increasingly relentless deployment of invasive surveillance and control measures, such as GPS tagging, signaling a further step in the criminalisation of migration. The extension of GPS tracking to people who arrive by small boats, many of whom have fled persecution, is the latest chapter in this escalation.

The ICO’s decision is a powerful reminder that migrants have the same data protection rights as everyone else, and that immigration authorities are not above the law. Data protection legal safeguards are not provided to people based on their citizenship status, but based on whose jurisdiction they are under. Immigration authorities in the UK and elsewhere have for far too long, and exponentially in recent years, been abusing migrants’ privacy in a bid to exercise performative power and control over a vulnerable population. This shows how privacy and data protection law can be a powerful tool in the protection and defence of migrants’ rights.

Conclusion

This decision a significant win for all those who were subject to this vindictive, costly and cruel policy. It will also require the Home Office to think harder about the necessity and proportionality of tagging individuals, and the wider model of blanket and indiscriminate surveillance of asylum seekers.
But this is not the end – data protection law is not all-powerful against racialised anti-migrant policies, and the Home Office will continue to tag migrants (albeit at a much smaller scale). This is why the GPS tagging policy is still facing multiple challenges in the courts by individual claimants – the first judgment was handed down on 12 March, and more are to come.

Contribution by: EDRi member, Privacy International