Windrush immigration papers scandal is a big fat GDPR fail for UK.gov It's probably a given that – with the European Union's GDPR now weeks away – you're sick to the back teeth of hearing, reading and talking about data protection. And then comes the Windrush scandal in which the UK government apparently destroyed the landing records for thousands of citizens from Caribbean nations who arrived …
Data protection legislation is genuinely a Good ThingTM. But many people use data protection as an excuse for not doing something. Most of the time, when someone says "I can't do that because of data protection" they're usually lying as they haven't the faintest clue about data protection and are just using it as an excuse to hide their laziness or incompetence.
"... as they haven't the faintest clue about data protection and are just using it as an excuse to hide their laziness or incompetence."
Hear, hear - deserves a beer. Ditto when they claim "Can't do that because of Health and Safety." or "Can't do that because of the EU." Always does bad things to my blood pressure, though I do sort of enjoy challenging folk who come up with excuses like that.
Informative article, thanks.
Given the British citizenship and UK residency rules that we have (why make something easy when you can make it pointlessly complicated?), it seems we'd need to hold information back up to grandparents. So those Windrush landing cards needed to be held for maybe 120-150 years.
Alternatively, the Home Office could get with the times come up with a system that means you don't need to keep years of paperwork up to your grandparents. Everyone would ask for residency on arrival, everyone would register with the council every time they move house, and everyone would be able to prove continuous residency five years later by granting the Home Office permission to look at residency/tax/NI histrory. Same for citizenship five years after that.
It seems to me they were aiming to go in that direction, but 1) didn't want to regularise because that would "send the wrong signal" but is essential when switching from the system we have now to a system like this, and 2) did it on the cheap by using the public as immigration officers, instead of just asking them to say "show me this card or certificate, if you haven't got one, get one from this place" right at the start, and 3) didn't give a toss about how many people's lives they screwed up as we can see by the fact that their hostile environment catches everyone who came before 1973 if their country wasn't independent.
Also Mayhem will probably use the opportunity to push for ID cards for everyone saying it can't be done without it, but countries like the Netherlands manage to operate a more coherent immigration system and have optional ID cards.
Sorry Alister, you may not like it but digitalise now is a word and has a different meaning to digitise. Digitise is things like scanning where we take assets and make them digital. Digitalisation is where we transform business processes to be digital first such that the paper never exists in the first place.
It is, as all words, made up. It has been around for a long time now though and is part of the language.
If the argument can be made that there is a legitimate reason for holding the data for more than a person's lifespan (IIRC the oldest person on record died at 124), then there is also no justification for getting rid of that data under GDPR - it is only considered to be Personally Identifying Information if it pertains to a 'Natural Living Person' - i.e. someone who is an actual person (not a legal entity of some sort), and is alive.
Logically, if you have to retain it while they're alive, under GDPR you don't have to get rid of it after they're dead, because it ceases to be PID on that date.
Agree with your comment, apart from the final three words. The Netherlands has "identiteitsplicht", an ID requirement. Basically everyone over 14 must at all times be able to show proof of identity and (depending on the circumstances) residence if requested by a policeman and certain other officials. Most Dutch citizens carry their credit card sized ID cards for this purpose. The cards are optional, and certainly more convenient than the alternative of carrying a passport. Non-Dutch EU-issued drivers licences may sometimes be treated as proof of identity but not residence.
When I lived in the Netherlands, I broke the strict letter of the law by carrying a drivers licence but not my passport. I never got fined, but it was sometimes inconvenient. e.g. when I forgot the post office would only let me pick up parcels if I had my passport.
Hilariously I was having this discussion while you were posting your comment... "can't look at the files of a person who's left because of data protection" not the case, and if it was what possible reason would there be for keeping them? (The full answer being, there may be some reasons to keep them and it can be looked at for those purposes with appropriate oversight.)
"Regardless of how, or what, you think of the Home Secretary at that time in 2010 (the British prime minister Theresa May herself), a minister or high-ranking civil servant overseeing the Windrush files should never have had to sign off on any data disposal. Good data administration policy should have been in place and meant it was part of a run-of-the-mill activity done once a month, or maybe once a quarter, without the need for upward reference."
And who signs off on the policy in the first place?
Each class of material needs its own policy. A sensible policy for these records would have been to treat them as being in the same class as BMD material and GRO are still storing everything in that category right back to the start of civil registration on the first of June 1837.
This is just another example of how the medieval system Britain still employs to track the status of its citizens and residents can't work in times when people move much more and easily.
If those people had to register at their new place of residence, there would be no need to keep paper record themselves of their entry, or ask for a passport - there would be a record of when they established in the country and where. US has the same issues when it comes to voting, for example.
Here when you establish somewhere you need to register as a "resident". It automatically endow you with specific rights - i.e. voting for correct constituency, attending local schools, obtaining a local physician for healthcare, etc. etc. Of course, it also means to know where you have to pay for local taxes.
And any time you can request a certificate stating where you are resident and how long.
I had relatives that were born in territories now no longer part of the country, and they never had issues to state they were actual citizens when they moved in after the war, even if the original records were destroyed long ago.
Is this Big Brother? Nah, it's just keeping needed records clean - and allow people to exercise their rights.
"allow people to exercise their rights"
One of the rights we've grown used to in the UK is not being challenged for our "papers".
On a practical basis how does such a paper-based registration system get booted? I can present to someone registering me a birth certificate of someone who looks roughly the right age but how do I prove I'm the person named on it? Does every baby get micro-chipped at birth so that in 70-80 years we have completely documented population?
We are not challenged to exhibit "our papers". The records were kept at the town level in the past, now they have been digitized and kept in a national database, because people move much more and more often than sixty years ago.
Yet, if any need arose to show you were a legitimate resident, you could always ask to obtain of a legally valid paper to show it - any time. No need to store and search old paper records in your basement.
Birth registration happens soon after birth - usually is made by the hospital directly for babies born there. Otherwise it can be done at a town office - you need to present a certificate made by the physician or obstetrician who helped the birth, plus a proof of your identity as a parent. No need of a chip, and here, identity thieves are almost non-existent.
Windrush people had paper - paper emitted by a UK authority in the Caribbeans, right? - that has been destroyed - if those papers had been used to register them as UK residents, there would be no issue today.
Like it or not, the State has lots of records about you already - you can ensure they are used to benefit you and assert your rights, or you can let it to do what it likes - including destroying them for ever-, against you, while being proud of not "being challenged for our papers".
One of the punishment in a dictatorship is exactly being made a non-citizen - denying even the basic rights.
"
Birth registration happens soon after birth - usually is made by the hospital directly for babies born there. Otherwise it can be done at a town office - you need to present a certificate made by the physician or obstetrician who helped the birth, plus a proof of your identity as a parent. No need of a chip, and here, identity thieves are almost non-existent.
"
If you lose (or claim to have lost) your birth certificate, you will need to apply for a duplicate. The birth certificate contains no information that identifies who it was issued to. No fingerprints, no DNA, not even a photograph. I can get a "duplicate" birth certificate of just about anyone who is approximately the same age as myself, just by knowing their date of birth, and claiming to be that person. I can then use that birth certificate to apply for a driving licence and/or passport. While I believe that a check is now made to ensure that the birth certificate was not originally issued to someone who was later issued with a death certificate, you could still use the birth certificate of someone who you know does not already have a UK passport / driving licence.
Channel 4 News did a panel session about Windrush earlier this week. One of the experts (sorry didn't get his name) said that this sort of thing could all be fixed if the government introduced ID cards. So don't be surprised if the Home Office attempts to recover from this fuck-up by reanimating the corpse of Blunkettcards and saying ID cards are needed to prevent further scandals - setting in motion a process that will create further fuck-ups.
What made the panel so odd, was that I found myself agreeing with Jacob Rees Mogg on the unBritishness of ID cards. At that point I thought it was time for the first gin of the evening.
ID cards are a smokescreen. They are not needed for the prevention of the problems.
For example: In Germany you have to have an ID card, but not with you. And the ID card proves nothing. Not that you are born, or even that you are a German citizen, even though it does state your nationality.
The only documents that really matter are the birth certificates (and these are only copies of the master registry) and/or your family register. The master documents stay with residency of the family. So you are still attached to your parents until you marry or have children. Makes fun getting marriage papers, if your parents did move often after you went your own ways. You are also required to register at the council hall of your main residency. Makes voting registers and some other things painless.
And we just had the proof, that the ID card and the passport prove nothing at all. My son and I had to get new ones. Even though we could ID with passport and ID card from that same council hall (after 10 years the old ended) and the same public servant, we had to provide proof of family registry. In my sons case the birth certificate. I could use the marriage certificate to validate myself and my wife for a future new ID card. As my daughter had her birth first registered within the same administrative region, she was by definiton validated.
At least now they have consolidated our family book after almost 20 years of marriage. Our master papers are now detached from out parents (with proper copies and documentation on the parent register) and form a new family book.
So ID cards are not necessary, only a central registry even without cards.
"Just keep the data for longer"? What sort of "solution" is that?
As has been pointed out above, Germany manages just fine without keeping a central register (that being banned by the Basic Law), and in any case I would have liked a discussion of Article 2 § 2 (b) of the GDPR as it applies to this situation.
"One of the rights we've grown used to in the UK is not being challenged for our "papers". "
Doesn't seem to be the case these days.
There's a massive kneejerk reaction to ID cards, and perhaps to the police being able to force you to identify yourself (which they can in a quite a large variety of circumstances, just not at will) but you absolutely get asked for your ID by the UK cops.
If you're a citizen who has never lived outside the country, then it's almost invisible, since mostly it's about proving your legal right to be here. But the people being hit by the Windrush scandal have had situations where they've been asked "papers please" and being unable to provide them, lost their jobs, rentals and access to healthcare.
So no ID card, no papers from the Home Office until you can prove your residency (auto reject unless 100% complete), but you'll need those papers.
Don't worry citizen. Your rights will always be protected.
"On a practical basis how does such a paper-based registration system get booted?"
When last Labour governement were attempting to set up ID cards then they were planning a nationwide set of offices (someone I know who works in business property had a job identifying suitable locations around Bristol) where everyone would need to report with the relevant birth certificates/passports/utility bills to get them onto the system so they could have an ID card issued
"One of the rights we've grown used to in the UK is not being challenged for our "papers". "
Takes a bit of cheek to post a comment like this to an article about people facing deportation because they have literally been challenged for papers, and those papers were shredded by the same government agency demanding them.
The reality of life in the UK is that you are constantly challenged for papers in order to do anything from opening a bank account to renting a flat. Therefore you either need government-issued ID like a passport or else you are at the mercy of whatever the deranged bureaucrat feels like asking for.
"On a practical basis how does such a paper-based registration system get booted?"
Since several european countries have successfully operated such systems for decades it's clearly not impossible outside the constraints of Little England.
"Does every baby get micro-chipped at birth so that in 70-80 years we have completely documented population?"
And yet more drivel showing that you completely fail to grasp the distinction between recording someones details and proving their identity. Sadly this is absolutely typical of people raised in a country where the authorities are unable to achieve either task.
While an ID card system works very well in many countries, it is not a panacea against discrimination and injustice. Take a look at the Chinese Hukou (household registration) system, which divides rural and urban residents, enforced mass rural starvation during the Great Leap Forward, and provides impoverished migrant workers to make our smartphones today.
Other examples risk invoking Godwin's Law.
You are completely missing the mark here.
The actual problem is that the Home Office is supposed to find illegal immigrants, found the task too hard, and decided that instead it would be a lot easier to find _legal_ immigrants who have problems proving what rights they have. Emphasis on _legal_ immigrants. To the destruction of sailing information: Why assume incompetence, when malice is a perfectly fine explanation?
And these _legal_ immigrants were never asked for any evidence, until more than 45 years later, when that evidence is impossible to get by. 9 years after the government destroyed important evidence - we should fall back to the normal civil court rules; if you destroy evidence then it should be assumed that the evidence was against you.
They weren't immigrants as such either. As residents in the British Empire, they had a right to settle in any other part of the Empire.
Setting aside what any exact legal definition is: These people were British before they came here, were British when here, are British even as the Home Office detains them, deports them, denies them jobs, benefits, welfare and healthcare. That's what makes it so appalling.
It is easy to see how it came about; "Illegal immigrants" are "those who shouldn't be here", which became "those without evidence of a right to be here", which meant many of the arrivals, unable to provide that evidence, were de facto "illegal immigrants".
The "hostile environment" May created turned "innocent until proven guilty" into "guilty unless proven innocent" and changed "balance of probability" to needing to provide absolute proof of innocence.
May, Rudd and the Home Office then merely concerned themselves with removing "Illegal immigrants", chased the targets they had promised, and cared little beyond that. It didn't matter who people were, only that they could be classed as "illegal immigrants". The Windrush generation without paperwork were easy targets, low-hanging fruit, "illegal immigrants" hiding in plain sight.
Every little helps. They were just numbers to callous Home Secretaries and a ruthless Home Office.
Well, you could argue they became British after Labour passed their 1948 nationalities act - for which there was no mandate - nor was it mentioned in their winning manifesto - every single poll on the matter since has shown a healthy lead for the "no immigration" side which has been derided and scoffed at from day one. The British people didn't want and still don't want mass immigration, but then listening to the people would mean democracy - and we can't have that now can we? Still, it's another fine excuse for bourgeois career politicians to self flagellate and virtue signal to their Guardian-reading pals - democracy is over-rated anyhow.
@RancidRodent - "Well, you could argue they became British after Labour passed their 1948 nationalities act"
But it would be a very weak argument - they became British when Britain annexed their territories as part of its Empire. British Subjects, to be exact. The 1948 act changed subjection to citizenship.
Imperialism created this mess, and the prejudices of the imperial mindset live on.
Those of us in the windrush situation, and there are plenty of Australians, Canadians, New Zealanders etc among us have been watching an increasingly hostile situation with concern for some time. In particular to prove my residency rights looked like being fairly serious money, hundreds at least, when actually there ought to be a data trail certainly of NI, and presumably of school records too going right back.
"the plan was to leave the building in which the documents were stored in."
There are other parts of government with other buildings who store documents with similar significance. The GRO, part of the Passport Office and, in turn, also part of the Home Office would have been entirely appropriate. John Reid wasn't wrong.
Think back to 2009. Cameron was fighting a flanking action from the usual suspects in the Tory party, and UKIP was on the warpath. Immigration was a big issue. The Home Office was desperate to show it could get immigrant numbers down.
Unfortunately, it didn't really have any legit options to do that. And so, instead, under intense pressure from several sides, May eventually finds a target she has some hope of hitting - by losing their paperwork.
It was as slimy a move as I can remember seeing. But it was what happens when politicians are pressured into making promises they can't keep. Brexit and Windrush are two outcomes of the same crisis.
And it smacks to me of the hiding behind the law excuses which has seen an explosion of the " 'elfin safety innit, mate? " brigade.
You know the sort... you have a simple question about something important, has someone done this, has someone said that, has such-and-such a person been in contact with you yet, have you informed such and such a person about this... and you always get one somewhere; one poxy ignoramus who will say "I'm sorry, I can't tell you that because of data protection". I've given YOU the name, you muppet... or I don't need to know the name, just to know if some event has occurred or some contact been made. As far as I'm aware a company as a legal entity, even if it's a sole trader, has no "personal" information status. Or do they?
"Did you receive the payment from Martin Fowler yet?" How's that a breach of any Data Protection, and how can it be different if it's Martin Fowler the individual or Martin Fowler Ltd the solicitor's company?
As for the historical records thing... that is utterly inexcusable. Parish Records, the old Somerset House as it was, wherever it's moved to, Microfiche copies of The Times... are we at risk of entering a new Dark Age?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
