How to fight the Home Office and Win: Subject Access Requests

STOP PRESS 

2017-03-11
Home Office advise foreigners to get themselves arrested if they want to get hold of their lists of trips abroad. (sort of  😣 ). Please scroll to "So the easiest way"
- or read the whole glorious story, my horribly mixed metaphors, and my call to arms (directly below).

2017-04-14 ICO respond again  Please scroll to end.

If you are an EU citizen resident in the UK you will probably have discovered by now that the UK Government is devoting a huge amount of time and effort towards making your life as difficult as possible.

If, fearing that the Home Office might arrest and deport you one day, you have decided to apply for formal recognition of your right to be in the UK (a right people notionally acquire after five years of living here) you will have discovered that you have to start the ball rolling by filling in an eighty-five page form.

The form asks, inter alia, for dates of departure, dates of return, and number of days away for every absence from the UK since entering the UK. In my wife’s case, this period spans thirty-one years. When I inquired about this requirement, I was assured that we “only” needed to fill this section in for the last five years.

Some time ago, the Home Office put up an online version of this form but many categories of EEA citizens are prohibited from using the online form and will have to use the paper form.

More recently, the Home Office quietly dropped the requirement to list exits and entries from the UK altogether – but only for those who are allowed to use the online form. In any case, EU applicants for naturalization (a different kettle of fish) in the UK also need to list entries to and exits from the UK for the last five years.

There is an added complication here which I should mention. The five years you choose to qualify for permanent residency do not actually have to be the most recent five years. So even if you are “only” filling in dates for five years of trips abroad you may need dates from longer ago than five years.

So how do you go about constructing your list of dates so that you can send them back to the Home Office?

Well funnily enough, the Home Office has a record of all your trips abroad (assuming you use airlines or ferries to travel rather than a rubber dingy across the Channel or whatever) and you can request a copy of this record and use the information therein to fill in your Home Office forms accurately. The Home Office only has records going back five years however so I presume (though I must emphasize I’m not an immigration lawyer) you can just fill in whatever you can remember for earlier years and the Home Office will have no way of checking the accuracy of what you fill in.

Obviously this is utterly bonkers, but if you are dealing with the Home Office you need to get used to bonkersness.

This is how we obtained our Home Office records using what’s called a “Subject Access Request” or “SAR”…….

The first thing to note is that, though the Home Office has a special form for SARs. You are under no obligation to use this form – which asks for all sorts of irrelevant information. Keep it simple and send them a letter simple letter!

We wrote as follows:

UKVI (Subject Access Request)
Lunar House
40 Wellesley Road
Croydon
CR9 2BY 

Dear Sir/Madam 

This is a Subject Access Request under section 7 of the Data Protection Act 

I am a  >nationality< citizen who has lived and worked in the UK since >date<. I am currently applying for a permanent residence card which requires me to list all my absences from the UK over the past years. 

Please could you supply all records you possess of my exits and entries from the UK since >date<. 

Yours faithfully 

>name< 

I enclose copies of my passports and driving licence and personal details. Please advise whether any fees are required in connection with this SAR.

NB the fee is a £10 cheque of postal order payable to The Home Office Accounting Office but (as will be made clear below) it is probably best not to bother with this at this stage.

The “personal details” we included were:

Name

Previous name

Date of birth

Place of birth

Date of Marriage to >spouse name<

Current UK address

Previous UK addresses

Phone

Email

Port of original entry to UK

Date of original entry to UK

This list reflected our circumstances and included things I could see on the Home Office SAR form that seemed potentially relevant. There is no hard and fast rule about what you need to tell them but they need to be able to identify you.

We also included photocopies of my wife’s birth certificate, driving licence, and all the passports she has used since coming to live in the UK. Again, there are no hard and fast rules here but at least one photo id is pretty much essential.

Once the Home Office have your SAR, they will then set about trying to think of reasons to turn it down (which is why there is no real point in paying them until you hear from them again). In our case they asked (expectedly) for a £10 cheque and (unexpectedly) for “certification” of the photo id copies we had supplied:

Now I don’t know about you, but I find the (implied) suggestion here – that a fraudster might have got hold of all my wife’s personal details and copies of all her passports and driving licence and birth certificate and might be using them (rather than to empty her bank account) to fool the Home Office into sending a list of dates to an address which the Home Office knows is ours – ever so slightly bonkers. Indeed, I’m going to stick my neck out here and suggest that the Home Office are being deliberately vexatious.

I decided I should report the Home Office to the Office of The information Commissioner for non-compliance with section 7 of the Data Protection Act. I filled in the relevant form; attached copies of all the material we had sent to the Home Office, and sent the following covering email:

Dear Sir/Madam 

This concerns a simple SAR for information that the Home Office hold on my wife’s movements in and out of the country over the past 31 years. The Home Office have this information because it is automatically sent to them by the airlines and ferry companies. My wife needs this information because the Home Office require her to provide it when she fills in a form for a residency permit. 

This information is not especially sensitive and would only ever be of use to someone applying for residency – at which point they have to appear in person and produce a passport. 

My wife provided copies of her driving licence, birth certificate and 5 passports and a great deal of personal details. It is preposterous of the Home Office to demand that she obtain the signature of a *solicitor* for these copies before they will process her request. This is more onerous than the requirements for obtaining a driving licence or passport in the first place. The Home Office appears to be behaving in an entirely vexatious and obstructive fashion here. If such practice were adopted generally, SAR would become a right in name only. 

The home Office have also requested a fee – which is fine. But I object to their insistence on resending the whole request rather than simply the cheque for the fee.
I look forward to hearing from you and I hope you can persuade the Home Office to start behaving in more reasonable fashion. 

etc

It seems that the Office of the Information Commissioner is, as I write, dealing with a backlog of complaints about the Home Office and is currently dealing with complaints submitted up to 2017 January 16 - three days before mine was submitted.

As ever, I shall report any outcome below.

Meanwhile we thought we had better find a solicitor and try resubmitting our SAR. At least the Home Office had now supplied a list of requirements that it would be difficult for them to go back on; and fortunately for us, we happen to have a good friend (of over twenty years' standing) who is a solicitor. It “cost” me only a bottle of wine (though a rather good one L) to cover our copies in signatures and rubber stamps that looked sufficiently impressive to intimidate the Home Office into submission.

I dread to think how much a solicitor charging commercial rates would charge for such a service.

We resubmitted out SAR and a cheque for £10:

Andrew Smith
Head of Subject Access Request Unit
Lunar House
40 Wellesley Road
Croydon
CR9 2BY
 Dear Mr Smith 

This is a Subject Access Request under section 7 of the Data Protection Act 

Thank you for your letter of January 16. 

I enclose solicitor-certified copies of my driving licence and passport and a cheque for £10 payable to “The Home Office Accounting Officer”. I also enclose copies of my birth certificate, former passports, and personal details. 

I trust you will now proceed with my SAR. 

To recap: 

I am a German citizen who has lived and worked in the UK since 1985. I am currently applying for a permanent residence card which requires me to list all my absences from the UK over the past thirty-one years. 

Please could you supply all records you possess of my exits and entries from the UK since August 1985. 

Yours sincerely etc

This time around, the Home Office deigned to comply with our request (and the law of the land):

And, just recently, we received our list of dates. (I am not sure why they put “File Copy” across these pages. Perhaps they want to give the impression that they keep the original pages in a drawer somewhere and have made photocopies specially to send to us? I consider it more likely that these pages were generated by someone clicking something on a computer.):

This list goes back only five years, so does not include my wife’s initial entry to the UK, and has her entering the UK two times more than she left the UK. It also records her nationality variously as German, Danish, and British. Otherwise the details seem to be correct – though how complete they are is hard to say. We travel a lot and don’t really keep our own records (though we are well within the days-away-per-year allowed to foreign residents by the Home Office).

At the end was some more general information about the data held by the Home Office:

So there you have it. We now know exactly what data the Home Office hold on us and we also know to keep records of all our trips abroad in future, just in case the UK government introduce even more draconian rules to control the movements of EU citizens. They certainly seem to be planning this.

If you need to know what the Home Office knows about your travel dates so that you can fill in their forms without fear of entering any data that conflicts with what they think they know, you will (as things stand) just have to bite the bullet and fork out lots of money for a solicitor to validate your documents. I hope, however (whether or not you currently need these dates), you will follow my suggestions below:

I have fought minor battles with bureaucracies all my life. I never give in and I never give up. I have won every single time. The UK Government has declared war on three million people and their families. It is essential we all win and that they lose.

I’m going to mix my metaphors a bit now, but I hope you’ll forgive me …………

All bureaucracies have an Achilles heel: The spikes in the pits they place in your way can be picked out and used as weapons to throw back at them and ultimately defeat them. And the more spiked-pits they place in front of you, the more spikes you can acquire.

And the pen is even mightier than the sword (which is a kind of spike).

Doing the following will do more good that writing to the newspapers or to your MP or fulminating on FaceBook and Twitter.

Write to the Subject Access Request Unit at, Lunar House, 40 Wellesley Road, Croydon, CR9 2BY requesting the data they hold on your trips abroad. This will cost you a few minutes and the price of a stamp. Do this now!

When they refuse your Subject Access Request (they will) fill in the form at https://ico.org.uk/media/report-a-concern/forms/1466/access-personal-information-form.pdf and send it to casework@ico.org.uk with a covering letter complaining that the Home Office are in breach of section 7 of the Data Protection Act. This will cost you nothing.

If thousands of us do this, I guarantee that the Home Office will, sooner or later, quietly drop its insistence that we employ expensive solicitors before submitting an SAR. If we keep up the fight, with luck, they will also drop the insistence on providing travel dates for all EU citizens in all circumstances. And when we win these battles you will have made life significantly easier for millions of your fellow human beings.

Pick up your pens/keyboards now and enter the fray!

#####

And now I've finally heard from the Office of the Information Commissioner:

from: casework@ico.org.uk11th March 2017 

Dear Dr Ward 

Thank you for raising concerns about the Home Office. 

 I understand that you have concerns about the ID requirements imposed by UKVI when it receives a subject access request (“SAR”). 

In this case, it appears that adequate certification has not been provided and has therefore UKVI will not process Karin XXXXXXXXXXX's SAR. 

 I can confirm that UKVI has now agreed to accept photo certification for SARs from; Solicitors, barristers, legal executives, registered charities and OISC registered representatives. The photo ID requirement will also be waived if the subject is in detention and UKVI can verify this from its records. 

 This change in policy has come about following the ICO’s engagement with UKVI on this matter. We understand that you believe that asking for a certified ID is excessive in the circumstances but this is UKVI's policy unless the above applies. 

We would advise that certified ID is still a requirement but as stated above it does not now necessarily have to be a solicitor that verifies the ID (see above). 

Therefore, you should now write to UKVI with a verified copy of ID in order to progress the SAR. There are no further actions for us to take on this occasion. 

Thank you for bringing this matter to our attention. 

Yours sincerely

etc

So the easiest way to obtain a list of your trips abroad from the Home Office seems to be to get yourself locked up in a detention centre.

I have launched an appeal with the Office of the Information Commissioner arguing that they have let the Home Office off the hook far too easily. I repeated my point that it is utterly unreasonable of the Home Office to insist on copy certification requirements that are far more onerous than the requirements for obtaining the original documents whose copies are being certified.

....and here's the reply:

Dear Dr Ward 

I am writing further to your case review and service complaint correspondence of 21 March 2017.  

This relates to the data protection concern submitted to the Information Commissioner’s Office (the “ICO”) about UK Visas and Immigration (“UKVI”), which is part of the Home Office. 

Please find enclosed a leaflet which explains how we handle requests for a case review.
The original concern raised with us refers to what you consider are the excessive proof of identity requirements insisted on by UKVI for processing subject access requests under the Data Protection Act 1998 (DPA). Joanna Hoof, the investigating officer, informed you that the ICO had previously engaged with UKVI on an earlier set of conditions imposed and it had been agreed that the rules should be made more accommodating. Under the terms of the agreed policy however your wife would still be required to provide further information and Ms Hoof recommended that your wife supply a verified copy of identification in order to progress the subject access request. 

I understand you remain of the view that UKVI’s requirements are disproportionate and unnecessarily onerous. [my emphasis] On this basis, you have asked us to reconsider our position on this particular case. 

Under the DPA a data controller is entitled to ask for enough information to judge whether the person making the request is the individual to who the personal data relates. As you acknowledge, the use of this mechanism may be an important safeguard for preventing personal data about one individual being sent to another. The key point though is that a data controller must be reasonable about what is asked for. The data controller should not, for example, request lots more information where there is already an ongoing relationship with the individual. 

A policy produced by a data controller which details the conditions for processing subject access requests should be tailored to reflect the nature of the information that is being handled. UKVI will regularly deal with information of a particularly sensitive nature and this is reflected in the strictness of its policy. We accept that as the custodian of confidential personal data it is appropriate for UKVI to have a policy in place which sets out clearly the criteria for dealing with subject access requests. For our purposes however, the demands of the policy should not be such so as to prevent an individual from being able to exercise their access rights in the DPA. 

We consider that the current version of UKVI’s policy, which evolved from changes made in the light of our advice, is generally successful in balancing the rights of the data subject with the need for ensuring there is adequate protection for personal data. I can fully appreciate why you would believe that UKVI’s arrangements are not suitable for your wife’s particular situation. [my emphasis] Yet, in our view it is not only essential UKVI has a robust policy in place but that furthermore, in the interests of fairness, this policy is applied as consistently as possible.[1] For this reason, I am satisfied that Ms Hoof gave you the correct advice. 

A case review is the final stage of the ICO’s case handling process. However, I appreciate that you may disagree with the assessment and our case review. If you remain dissatisfied the enclosed leaflet outlines the options available to you. 

Yours sincerely etc

[1] I have since discovered the the Home Office has a "fast track" system for dealing with SARs that does not involve certification of ID copies so all talk of "robustness" and "consistency" here is entirely misplaced.

My translation:

"We kind of agree the the Home Office are just being arseholes here but their obduracy is not quite extreme enough for us to consider taking legal action against them so we're going to continue letting them break the spirit of the law."

Ombudsman here we go.