The UK Home Office and our Subject Access Request

If you are an EU citizen resident in the UK you will probably have discovered by now that the UK Government is devoting a huge amount of time and effort towards making your life as difficult as possible.

If, fearing that the Home Office might arrest and deport you one day, you have decided to apply for formal recognition of your right to be in the UK (a right people notionally acquire after five years of living here) you will have discovered that you have to start the ball rolling by filling in an eighty-five page form.

The form asks, inter alia, for dates of departure, dates of return, and number of days away for every absence from the UK since entering the UK. In my wife’s case, this period spans thirty-one years. When I inquired about this requirement, I was assured that we “only” needed to fill this section in for the last five years.

Some time ago, the Home Office put up an online version of this form but many categories of EEA citizens are prohibited from using the online form and will have to use the paper form.

More recently, the Home Office quietly dropped the requirement to list exits and entries from the UK altogether – but only for those who are allowed to use the online form. In any case, EU applicants for naturalization (a different kettle of fish) in the UK also need to list entries to and exits from the UK for the last five years.

There is an added complication here which I should mention. The five years you choose to qualify for permanent residency do not actually have to be the most recent five years. So even if you are “only” filling in dates for five years of trips abroad you may need dates from longer ago than five years.

So how do you go about constructing your list of dates so that you can send them back to the Home Office?

Well funnily enough, the Home Office has a record of all your trips abroad (assuming you use airlines or ferries to travel rather than a rubber dingy across the Channel or whatever) and you can request a copy of this record and use the information therein to fill in your Home Office forms accurately. The Home Office only has records going back five years however so I presume (though I must emphasize I’m not an immigration lawyer) you can just fill in whatever you can remember for earlier years and the Home Office will have no way of checking the accuracy of what you fill in.

This is how we obtained our Home Office records using what’s called a “Subject Access Request” or “SAR”…….

The first thing to note is that, though the Home Office has a special form for SARs. You are under no obligation to use this form – which asks for all sorts of irrelevant information. We just sent them a simple letter:

UKVI (Subject Access Request)
Lunar House
40 Wellesley Road
Croydon
CR9 2BY 

Dear Sir/Madam 

This is a Subject Access Request under section 7 of the Data Protection Act 

I am a  >nationality< citizen who has lived and worked in the UK since >date<. I am currently applying for a permanent residence card which requires me to list all my absences from the UK over the past years. 

Please could you supply all records you possess of my exits and entries from the UK since >date<. 

Yours faithfully 

>name< 

I enclose copies of my passports and driving licence and personal details. Please advise whether any fees are required in connection with this SAR.

The “personal details” we included were:

Name

Previous name

Date of birth

Place of birth

Date of Marriage to >spouse name<

Current UK address

Previous UK addresses

Phone

Email

Port of original entry to UK

Date of original entry to UK

This list reflected our circumstances and included things I could see on the Home Office SAR form that seemed potentially relevant. There seems to be no hard and fast rules about what you need to tell them but obviously they need to be able to identify you.

We also included photocopies of my wife’s birth certificate, driving licence, and all the passports she has used since coming to live in the UK.

Once the Home Office had our SAR, they they asked (expectedly) for a £10 cheque and (unexpectedly) for “certification” of the photo id copies we had supplied:

Now I don’t know about you, but I find the (implied) suggestion here – that a fraudster might have got hold of all my wife’s personal details and copies of all her passports and driving licence and birth certificate and might be using them (rather than to empty her bank account) to fool the Home Office into sending a list of dates to an address which the Home Office knows is ours - rather implausible. Indeed, I’m going to stick my neck out here and suggest that the Home Office are being deliberately vexatious.

I decided I should report the Home Office to the Office of The information Commissioner for non-compliance with section 7 of the Data Protection Act. I filled in the relevant form; attached copies of all the material we had sent to the Home Office, and sent the following covering email:

Dear Sir/Madam 

This concerns a simple SAR for information that the Home Office hold on my wife’s movements in and out of the country over the past 31 years. The Home Office have this information because it is automatically sent to them by the airlines and ferry companies. My wife needs this information because the Home Office require her to provide it when she fills in a form for a residency permit. 

This information is not especially sensitive and would only ever be of use to someone applying for residency – at which point they have to appear in person and produce a passport. 

My wife provided copies of her driving licence, birth certificate and 5 passports and a great deal of personal details. It is preposterous of the Home Office to demand that she obtain the signature of a *solicitor* for these copies before they will process her request. This is more onerous than the requirements for obtaining a driving licence or passport in the first place. The Home Office appears to be behaving in an entirely vexatious and obstructive fashion here. If such practice were adopted generally, SAR would become a right in name only. 

The home Office have also requested a fee – which is fine. But I object to their insistence on resending the whole request rather than simply the cheque for the fee.
I look forward to hearing from you and I hope you can persuade the Home Office to start behaving in more reasonable fashion. 

etc

It seems that the Office of the Information Commissioner were, as I wrote, dealing with a backlog of complaints about the Home Office and was, at that stage, dealing with complaints submitted up to 2017 January 16 - three days before mine was submitted.

Meanwhile we thought we had better find a solicitor and try resubmitting our SAR. At least the Home Office had now supplied a list of requirements that it would be difficult for them to go back on; and fortunately for us, we happened to have a good friend (of over twenty years' standing) who was a solicitor. It “cost” me only a bottle of wine (though a rather good one L) to cover our copies in signatures and rubber stamps that looked sufficiently impressive to intimidate the Home Office into submission.

I dread to think how much a solicitor charging commercial rates would charge for such a service.

We resubmitted out SAR and a cheque for £10:

Andrew Smith
Head of Subject Access Request Unit
Lunar House
40 Wellesley Road
Croydon
CR9 2BY
 Dear Mr Smith 

This is a Subject Access Request under section 7 of the Data Protection Act 

Thank you for your letter of January 16. 

I enclose solicitor-certified copies of my driving licence and passport and a cheque for £10 payable to “The Home Office Accounting Officer”. I also enclose copies of my birth certificate, former passports, and personal details. 

I trust you will now proceed with my SAR. 

To recap: 

I am a German citizen who has lived and worked in the UK since 1985. I am currently applying for a permanent residence card which requires me to list all my absences from the UK over the past thirty-one years. 

Please could you supply all records you possess of my exits and entries from the UK since August 1985. 

Yours sincerely etc

This time around, the Home Office deigned to comply with our request (and the law of the land):

And, just recently, we received our list of dates. (I am not sure why they put “File Copy” across these pages. Perhaps they want to give the impression that they keep the original pages in a drawer somewhere and have made photocopies specially to send to us? I consider it more likely that these pages were generated by someone clicking something on a computer.):

This list goes back only five years, so does not include my wife’s initial entry to the UK, and has her entering the UK two times more than she left the UK. It also records her nationality variously as German, Danish, and British. Otherwise the details seem to be correct – though how complete they are is hard to say. We travel a lot and don’t really keep our own records (though we are well within the days-away-per-year allowed to foreign residents by the Home Office).

At the end was some more general information about the data held by the Home Office:

So there you have it. We now know exactly what data the Home Office hold on us and we also know to keep records of all our trips abroad in future, just in case the UK government introduce even more draconian rules to control the movements of EU citizens. They certainly seem to be planning this.

Later, I finally heard from the Office of the Information Commissioner:

from: casework@ico.org.uk11th March 2017 

Dear Dr Ward 

Thank you for raising concerns about the Home Office. 

 I understand that you have concerns about the ID requirements imposed by UKVI when it receives a subject access request (“SAR”). 

In this case, it appears that adequate certification has not been provided and has therefore UKVI will not process Karin XXXXXXXXXXX's SAR. 

 I can confirm that UKVI has now agreed to accept photo certification for SARs from; Solicitors, barristers, legal executives, registered charities and OISC registered representatives. The photo ID requirement will also be waived if the subject is in detention and UKVI can verify this from its records. 

 This change in policy has come about following the ICO’s engagement with UKVI on this matter. We understand that you believe that asking for a certified ID is excessive in the circumstances but this is UKVI's policy unless the above applies. 

We would advise that certified ID is still a requirement but as stated above it does not now necessarily have to be a solicitor that verifies the ID (see above). 

Therefore, you should now write to UKVI with a verified copy of ID in order to progress the SAR. There are no further actions for us to take on this occasion. 

Thank you for bringing this matter to our attention. 

Yours sincerely

etc

So the easiest way to obtain a list of your trips abroad from the Home Office seems to be to get yourself locked up in a detention centre.

I launched an appeal with the Office of the Information Commissioner arguing that they had let the Home Office off the hook far too easily. I repeated my point that it is utterly unreasonable of the Home Office to insist on copy certification requirements that are far more onerous than the requirements for obtaining the original documents whose copies are being certified.

.This is the reply I received:

Dear Dr Ward 

I am writing further to your case review and service complaint correspondence of 21 March 2017.  

This relates to the data protection concern submitted to the Information Commissioner’s Office (the “ICO”) about UK Visas and Immigration (“UKVI”), which is part of the Home Office. 

Please find enclosed a leaflet which explains how we handle requests for a case review.
The original concern raised with us refers to what you consider are the excessive proof of identity requirements insisted on by UKVI for processing subject access requests under the Data Protection Act 1998 (DPA). Joanna Hoof, the investigating officer, informed you that the ICO had previously engaged with UKVI on an earlier set of conditions imposed and it had been agreed that the rules should be made more accommodating. Under the terms of the agreed policy however your wife would still be required to provide further information and Ms Hoof recommended that your wife supply a verified copy of identification in order to progress the subject access request. 

I understand you remain of the view that UKVI’s requirements are disproportionate and unnecessarily onerous. [my emphasis] On this basis, you have asked us to reconsider our position on this particular case. 

Under the DPA a data controller is entitled to ask for enough information to judge whether the person making the request is the individual to who the personal data relates. As you acknowledge, the use of this mechanism may be an important safeguard for preventing personal data about one individual being sent to another. The key point though is that a data controller must be reasonable about what is asked for. The data controller should not, for example, request lots more information where there is already an ongoing relationship with the individual. 

A policy produced by a data controller which details the conditions for processing subject access requests should be tailored to reflect the nature of the information that is being handled. UKVI will regularly deal with information of a particularly sensitive nature and this is reflected in the strictness of its policy. We accept that as the custodian of confidential personal data it is appropriate for UKVI to have a policy in place which sets out clearly the criteria for dealing with subject access requests. For our purposes however, the demands of the policy should not be such so as to prevent an individual from being able to exercise their access rights in the DPA. 

We consider that the current version of UKVI’s policy, which evolved from changes made in the light of our advice, is generally successful in balancing the rights of the data subject with the need for ensuring there is adequate protection for personal data. I can fully appreciate why you would believe that UKVI’s arrangements are not suitable for your wife’s particular situation. [my emphasis] Yet, in our view it is not only essential UKVI has a robust policy in place but that furthermore, in the interests of fairness, this policy is applied as consistently as possible.[1] For this reason, I am satisfied that Ms Hoof gave you the correct advice. 

A case review is the final stage of the ICO’s case handling process. However, I appreciate that you may disagree with the assessment and our case review. If you remain dissatisfied the enclosed leaflet outlines the options available to you. 

Yours sincerely etc

[1] I have since discovered the the Home Office has a "fast track" system for dealing with SARs that does not involve certification of ID copies so all talk of "robustness" and "consistency" here is entirely fanciful.