STOP PRESS
2017-03-11
Home Office advise foreigners to get themselves arrested if they want to get hold of their lists of trips abroad. (sort of 😣 ). Please scroll to "So the easiest way"
- or read the whole glorious story, my horribly mixed metaphors, and my call to arms (directly below).
2017-04-14 ICO respond again Please scroll to end.
If you are an EU citizen resident in the UK you will
probably have discovered by now that the UK Government is devoting a huge
amount of time and effort towards making your life as difficult as possible.
If, fearing that the Home Office might arrest and deport you
one day, you have decided to apply for formal recognition of your right to be
in the UK (a right people notionally acquire after five years of living here)
you will have discovered that you have to start the ball rolling by filling in
an
eighty-five
page form.
Some time ago, the Home Office put up an online version of
this form
but many categories of EEA citizens are prohibited from using the online form and
will have to use the paper form.
More recently, the Home Office quietly dropped the
requirement to list exits and entries from the UK altogether – but only for
those who are allowed to use the online form. In any case, EU applicants for naturalization (a different kettle of
fish) in the UK also need to list entries to and exits from the UK for the last
five years.
There is an added complication here which I should mention.
The five years you choose to qualify for permanent residency do not actually
have to be the most recent five years. So even if you are “only” filling in
dates for five years of trips abroad you may need dates from longer ago than
five years.
So how do you go about constructing your list of dates so
that you can send them back to the Home Office?
Well funnily enough, the Home Office has a record of all
your trips abroad (assuming you use airlines or ferries to travel rather than a
rubber dingy across the Channel or whatever) and you can request a copy of this
record and use the information therein to fill in your Home Office forms
accurately. The Home Office only has records going back five years however so I
presume (though I must emphasize I’m not an immigration lawyer) you can just
fill in whatever you can remember for earlier years and the Home Office will
have no way of checking the accuracy of what you fill in.
Obviously this is utterly bonkers, but if you are dealing
with the Home Office you need to get used to bonkersness.
This is how we obtained our Home Office records using what’s
called a “Subject Access Request” or “SAR”…….
The first thing to note is that, though the Home Office has
a special form for SARs. You are under no obligation to use this form – which
asks for all sorts of irrelevant information. Keep it simple and send them a
letter simple letter!
We wrote as follows:
UKVI (Subject
Access Request)
Lunar House
40 Wellesley Road
Croydon
CR9 2BY
Dear Sir/Madam
This is a Subject
Access Request under section 7 of the Data Protection Act
I am a >nationality< citizen who has
lived and worked in the UK since >date<. I am currently applying for a
permanent residence card which requires me to list all my absences from the UK
over the past years.
Please could you supply all records you
possess of my exits and entries from the UK since >date<.
Yours faithfully
>name<
I enclose copies of my passports and
driving licence and personal details. Please advise whether any fees are
required in connection with this SAR.
NB the fee is a £10 cheque of postal order payable to The
Home Office Accounting Office but (as will be made clear below) it is probably
best not to bother with this at this stage.
The “personal details” we included were:
Name
|
Previous
name
|
Date of
birth
|
Place of
birth
|
Date of
Marriage to >spouse name<
|
Current UK
address
|
Previous UK
addresses
|
Phone
|
Email
|
Port of
original entry to UK
|
Date of
original entry to UK
|
This list reflected our circumstances and included things I
could see on the Home Office SAR form that seemed potentially relevant. There
is no hard and fast rule about what you need to tell them but they need to be
able to identify you.
We also included photocopies of my wife’s birth certificate,
driving licence, and all the passports she has used since coming to live in the
UK. Again, there are no hard and fast rules here but at least one photo id is
pretty much essential.
Once the Home Office have your SAR, they will then set about
trying to think of reasons to turn it down (which is why there is no real point
in paying them until you hear from them again). In our case they asked (expectedly)
for a £10 cheque and (unexpectedly) for “certification” of the photo id copies
we had supplied:
Now I don’t know about you, but I find the (implied) suggestion
here – that a fraudster might have got hold of all my wife’s personal details
and copies of all her passports and driving licence and birth certificate and might
be using them (rather than to empty her bank account) to fool the Home Office
into sending a list of dates to an address which the Home Office knows is ours –
ever so slightly bonkers. Indeed, I’m going to stick my neck out here and
suggest that the Home Office are being deliberately vexatious.
I decided I should report the Home Office to the Office of
The information Commissioner for non-compliance with section 7 of the Data
Protection Act. I filled in the relevant
form;
attached copies of all the material we had sent to the Home Office, and sent
the following covering email:
Dear Sir/Madam
This concerns a simple SAR for
information that the Home Office hold on my wife’s movements in and out of the
country over the past 31 years. The Home Office have this information because
it is automatically sent to them by the airlines and ferry companies. My wife
needs this information because the Home Office require her to provide it when
she fills in a form for a residency permit.
This information is not
especially sensitive and would only ever be of use to someone applying for
residency – at which point they have to appear in person and produce a
passport.
My wife provided copies of her
driving licence, birth certificate and 5 passports and a great deal of personal
details. It is preposterous of the Home Office to demand that she obtain the
signature of a *solicitor* for these copies before they will process her
request. This is more onerous than the requirements for obtaining a driving
licence or passport in the first place. The Home Office appears to be behaving
in an entirely vexatious and obstructive fashion here. If such practice were
adopted generally, SAR would become a right in name only.
The home Office have also
requested a fee – which is fine. But I object to their insistence on resending
the whole request rather than simply the cheque for the fee.
I look forward to hearing from
you and I hope you can persuade the Home Office to start behaving in more
reasonable fashion.
etc
It seems that the Office of the Information Commissioner is,
as I write, dealing with a backlog of complaints about the Home Office and is
currently dealing with complaints submitted up to 2017 January 16 - three days before
mine was submitted.
As ever, I shall report any outcome below.
Meanwhile we thought we had better find a solicitor and try resubmitting
our SAR. At least the Home Office had now supplied a list of requirements that
it would be difficult for them to go back on; and fortunately for us, we happen
to have a good friend (of over twenty years' standing) who is a solicitor. It “cost”
me only a bottle of wine (though a rather good one L) to cover our copies in
signatures and rubber stamps that looked sufficiently impressive to intimidate the
Home Office into submission.
I dread to think how much a solicitor charging commercial
rates would charge for such a service.
We resubmitted out SAR and a cheque for £10:
Andrew
Smith
Head of Subject Access Request Unit
Lunar House
40 Wellesley Road
Croydon
CR9 2BY
Dear Mr Smith
This is a Subject
Access Request under section 7 of the Data Protection Act
Thank you for your letter of January 16.
I enclose solicitor-certified copies of
my driving licence and passport and a cheque for £10 payable to “The Home
Office Accounting Officer”. I also enclose copies of my birth certificate,
former passports, and personal details.
I trust you will now proceed with my SAR.
To recap:
I am a German citizen who has lived and
worked in the UK since 1985. I am currently applying for a permanent residence
card which requires me to list all my absences from the UK over the past
thirty-one years.
Please could you supply all records you
possess of my exits and entries from the UK since August 1985.
Yours sincerely etc
This time around, the Home Office deigned to comply with our
request (and the law of the land):
And, just recently, we received our list of dates. (I am not
sure why they put “File Copy” across these pages. Perhaps they want to give the
impression that they keep the original pages in a drawer somewhere and have
made photocopies specially to send to us? I consider it more likely that these
pages were generated by someone clicking something on a computer.):
This list goes back only five years, so does not include my
wife’s initial entry to the UK, and has her entering the UK two times more than
she left the UK. It also records her nationality variously as German, Danish,
and British. Otherwise the details seem to be correct – though how complete
they are is hard to say. We travel a lot and don’t really keep our own records
(though we are well within the days-away-per-year allowed to foreign residents by the
Home Office).
At the end was some more general information about the data
held by the Home Office:
So there you have it. We now know exactly what data the Home
Office hold on us and we also know to keep records of all our trips abroad in
future, just in case the UK government introduce even more draconian rules to
control the movements of EU citizens. They certainly seem to be planning this.
If you need to know what the Home Office knows about your
travel dates so that you can fill in their forms without fear of entering any
data that conflicts with what they think they know, you will (as things stand)
just have to bite the bullet and fork out lots of money for a solicitor to
validate your documents. I hope, however (whether or not you currently need
these dates), you will follow my suggestions below:
I have fought minor battles with bureaucracies all my life.
I never give in and I never give up. I have won every single time. The UK
Government has declared war on three million people and their families. It is essential
we all win and that they lose.
I’m going to mix my metaphors a bit now, but I hope you’ll
forgive me …………
All bureaucracies have an Achilles heel: The spikes in the
pits they place in your way can be picked out and used as weapons to throw back
at them and ultimately defeat them. And the more spiked-pits they place in
front of you, the more spikes you can acquire.
And the pen is even mightier than the sword (which is a kind
of spike).
Doing the following will do more good that writing to the newspapers
or to your MP or fulminating on FaceBook and Twitter.
Write to the Subject Access
Request Unit at, Lunar House, 40 Wellesley Road, Croydon, CR9 2BY requesting
the data they hold on your trips abroad. This will cost you a few minutes and
the price of a stamp. Do this now!
If thousands of us do this, I guarantee
that the Home Office will, sooner or later, quietly drop its insistence that we
employ expensive solicitors before submitting an SAR. If we keep up the
fight, with luck, they will also drop the insistence on providing travel dates for all EU citizens in all circumstances. And when we win these battles you will have made
life significantly easier for millions of your fellow human beings.
Pick up your pens/keyboards now and enter
the fray!
#####
And now I've finally heard from the Office of the Information Commissioner:
from: casework@ico.org.uk11th March 2017
Dear Dr Ward
Thank you for raising concerns about the Home Office.
I understand that you have concerns about the ID requirements imposed by UKVI
when it receives a subject access request (“SAR”).
In this case, it appears that adequate certification has not been provided and
has therefore UKVI will not process Karin
XXXXXXXXXXX's SAR.
I can confirm that UKVI has now agreed to accept photo certification for SARs
from; Solicitors, barristers, legal executives, registered charities and OISC
registered representatives. The photo ID requirement will also be waived if the
subject is in detention and UKVI can verify this from its records.
This change in policy has come about following the ICO’s engagement with UKVI
on this matter. We understand that you believe that asking for a
certified ID is excessive in the circumstances but this is UKVI's policy
unless the above applies.
We would advise that certified ID is still a requirement but as stated above it
does not now necessarily have to be a solicitor that verifies the ID (see
above).
Therefore, you should now write to UKVI with a verified copy of ID in order to
progress the SAR. There are no further actions for us to take on this occasion.
Thank you for bringing this matter to our attention.
Yours
sincerely
etc
So the easiest way to obtain a list of your trips abroad from the Home Office seems to be to get yourself locked up in a detention centre.
I have launched an appeal with the Office of the Information Commissioner arguing that they have let the Home Office off the hook far too easily. I repeated my point that it is utterly unreasonable of the Home Office to insist on copy certification requirements that are far more onerous than the requirements for obtaining the
original documents whose copies are being certified.
....and here's the reply:
Dear Dr Ward
I am writing further to your case review and service complaint correspondence of 21 March 2017.
This relates to the data protection concern submitted to the Information Commissioner’s Office (the “ICO”) about UK Visas and Immigration (“UKVI”), which is part of the Home Office.
Please find enclosed a leaflet which explains how we handle requests for a case review.
The original concern raised with us refers to what you consider are the excessive proof of identity requirements insisted on by UKVI for processing subject access requests under the Data Protection Act 1998 (DPA). Joanna Hoof, the investigating officer, informed you that the ICO had previously engaged with UKVI on an earlier set of conditions imposed and it had been agreed that the rules should be made more accommodating. Under the terms of the agreed policy however your wife would still be required to provide further information and Ms Hoof recommended that your wife supply a verified copy of identification in order to progress the subject access request.
I understand you remain of the view that UKVI’s requirements are disproportionate and unnecessarily onerous. [my emphasis] On this basis, you have asked us to reconsider our position on this particular case.
Under the DPA a data controller is entitled to ask for enough information to judge whether the person making the request is the individual to who the personal data relates. As you acknowledge, the use of this mechanism may be an important safeguard for preventing personal data about one individual being sent to another. The key point though is that a data controller must be reasonable about what is asked for. The data controller should not, for example, request lots more information where there is already an ongoing relationship with the individual.
A policy produced by a data controller which details the conditions for processing subject access requests should be tailored to reflect the nature of the information that is being handled. UKVI will regularly deal with information of a particularly sensitive nature and this is reflected in the strictness of its policy. We accept that as the custodian of confidential personal data it is appropriate for UKVI to have a policy in place which sets out clearly the criteria for dealing with subject access requests. For our purposes however, the demands of the policy should not be such so as to prevent an individual from being able to exercise their access rights in the DPA.
We consider that the current version of UKVI’s policy, which evolved from changes made in the light of our advice, is generally successful in balancing the rights of the data subject with the need for ensuring there is adequate protection for personal data. I can fully appreciate why you would believe that UKVI’s arrangements are not suitable for your wife’s particular situation. [my emphasis] Yet, in our view it is not only essential UKVI has a robust policy in place but that furthermore, in the interests of fairness, this policy is applied as consistently as possible.[1] For this reason, I am satisfied that Ms Hoof gave you the correct advice.
A case review is the final stage of the ICO’s case handling process. However, I appreciate that you may disagree with the assessment and our case review. If you remain dissatisfied the enclosed leaflet outlines the options available to you.
Yours sincerely etc
[1] I have since discovered the the Home Office has a "fast track" system for dealing with SARs that does not involve certification of ID copies so all talk of "robustness" and "consistency" here is entirely misplaced.
My translation:
"We kind of agree the the Home Office are just being arseholes here but their obduracy is not quite extreme enough for us to consider taking legal action against them so we're going to continue letting them break the spirit of the law."
Ombudsman here we go.
