R (HM and MA and KH) v Secretary of State for the Home Department

Name of case: R (on the application of HM and MA and KH) v Secretary of State for the Home Department

Court: High Court (Administrative Court)

Case No.: CO/4793/2020 and CO/577/2021 (joined)

Status: Closed

The case

In January 2022, Privacy International filed written submissions as intervener in a landmark case challenging the practice of mobile phone extraction (‘MPE’) by UK immigration authorities. The case was brought by asylum seekers against the Home Office, seeking judicial review of a policy and practice of seizing mobile phones from all migrants arriving to the UK by small boat, and in some cases extracting data from these phones.

The claimants are asylum seekers who arrived in the UK by small boat in 2020, and whose phones were seized on arrival by UK immigration authorities. The case revealed that the Home Office had for some time operated a secret and blanket policy and practice of seizing the phone of every asylum seeker arriving by small boat, retaining these phones for at least 3 months, and extracting (or planning to extract) sensitive personal data. The Home Office admitted that the policy was unlawful, on limited grounds.

At the time of the Claimants’ arrival, the Home Office policy was to extract personal data going back 30 days prior to the arrival of the asylum seekers in the UK. Prior to this it is understood that all data was extracted. Immigration authorities then sifted the extracted data for evidence of criminal activity, integrated and combined the data with other databases operated by other law enforcement agencies, and stored that data in those databases. While the policy has now evolved multiple times, seizures and extractions continue to this day, albeit in much lower numbers.

Phone seizures can cause asylum seekers substantial distress, leaving them without means of communication for months, and taking away photographs and other memories of family and friends. Subsequent extraction of data from these phones constitutes a considerable interference with their privacy - mobile phone extraction involves the ability to access vast quantities of data including call records, contents of emails, SMS and other messages, photographs, web browsing history, geolocation data, or data from applications (social media, health apps, etc).

The claimants sought judicial review of the Home Office’s MPE policy and practice, on the following grounds:

1. The search of the Claimans’ persons and seizure of the Claimants’ phones were unlawful (under the Immigration Act 1971 and Immigration Act 2016 respectively)
2. The Home Office did not have a right to compel provision of the PIN numbers of asylum seekers - this demand represented a very serious abuse of power, especially given the imbalance of power in these circumstances
3. The Home Office’s MPE policy was unlawful because it was secret, blanket and fettered (i.e. leaving no discretion to individual officers as to when and how to apply it)
4. The policy of phone seizure and retention constituted a disproportionate infringement of the Claimants’ rights under Article 8 of the European Convention on Human Rights (‘ECHR’)
5. The seizure and retention of phones, and the extraction and further use of data, were incompatible with the Home Office’s obligations as a data controller under the Data Protection Act 2018 (‘DPA 2018’)
6. The extraction and further processing of data from the phones constituted a disproportionate infringement of the Claimants’ rights under Article 8 of the ECHR

PI’s Intervention

PI had been researching MPE since 2017, and in March 2018 made a complaint to the Information Commissioner’s Office (ICO), the UK data protection authority, in relation to the use of MPE by police forces in the UK. This complaint led to a critical report by the ICO, denouncing the considerable interference of MPE with individuals’ privacy and requiring better governance and safeguards around its use.

Our intervention sought to contribute our technological and legal expertise around MPE, and demonstrate to the court the extent of the privacy intrusion it involves. In our submissions, we argued that:
(1) MPE constitutes a serious interference with the right to privacy, which can be justified only by cogent reasons
(2) The ECHR requires that prior independent authorisation be obtained before data from an individual’s mobile phone is extracted
(3) The Home Office has failed to discharge its burden of demonstrating necessity and proportionality of MPE

Our submissions were supported by a witness statement which sought to help the court by:

• Explaining how data extraction technically works, presenting the various methods available to authorities and detailing their various implications
• Providing our understanding, based on evidence filed in the case, of the way the Home Office analyses data extracted by MPE
• Detailing the various types of information which data extraction and analysis can reveal, and showing how intrusive this can be
• Raising concerns about the impact of MPE on the privacy of phone owners and third parties whose personal data can be contained on someone’s phone

The case was heard in the High Court from 25 to 28 January 2022.

Judgment was handed down on 25 March 2022. The High Court ruled that the secret and blanket policy of the UK Home Office to seize and search migrants' phones breached Article 8 ECHR and data protection laws. See our analysis of the judgment.

Consequentials/Remedies Judgment

A further judgment was handed down on 14 October 2022, dealing with the consequences of the 25 March judgment, in particular with the issues of "duty of candour" and relief.

Duty of candour

The duty of candour is a fundamental principle in judicial review proceedings in the UK. It provides that "A public authority’s objective must not be to win the litigation at all costs but to assist the court in reaching the correct result and thereby to improve standards in public administration". This requires a public authority to handle the litigation with "integrity, honesty, objectivity and impartiality".

In the present case, when lawyers representing the Home Office responded to initial "pre-action letters", they denied that there had been a blanket policy of seizure of mobile phones which they thought might be unlawful. It emerged through incremental disclosure in the proceedings that they in fact knew at that stage that the the blanket policy had existed and that it might be unlawful, however they wrongly believed it had been abrogated in June 2020. When this emerged in June 2021, the Home Office issued an unreserved apology to the Court.

To clarify the lawyers' belief at pre-action stage, the High Court, in a highly unusual move, ordered waiver of legal professional privilege in the advice provided by the barrister instructed by the government in early stages of the proceedings. This revealed a number of misunderstandings and unclear exhibition of facts, and thereby explained the legal team's mistaken belief. According to the Court, full early disclosure of the facts would have led to further inquiries by the Claimants' solicitors and would likely have led to the truth being uncovered before it was. Lord Justice Edis stated that "[i]f it had been set out accurately, this would have led to a much more rapid realisation that the June 2020 change in policy did not affect the seizure policy, but only the policy as to extraction of data following seizure. This should have led to a much earlier resolution of these proceedings." [39]

The High Court found this overall amounted to "a collective error of judgment" [38] which constituted a breach of the Secretary of State's duty of candour.

Relief

The question of remedies was settled out of Court - the Court therefore did not deal with nor disclose the type of remedies provided to the Claimants in the case. However, the Court dealt with a number of residual relief issues.

The most crucial issue which sparked lengthy debates between Claimants and Defendant during the hearing was the issue of dissemination of the judgment to those who may be affected by it, outside of the Claimants in the case - "that is to say, those who may have suffered illegality at the hands of the defendant as a result of a mobile phone policy and any purported use of s.48" [52].

The Home Office had, after the 25 March judgment, sent letters informing individuals whose phones were seized during operation of the unlawful policy of the data breach identified under the Data Protection Act 2018, recognising that the policy to seize and extract data was unlawful. The Court found the letters to be insufficient, in particular because "the unlawfulness identified by this court is both serious and stems from what can only be described as systemic failings on the part of the defendant. My Lord has referred to it in his judgment today as a "failure of governance."" [54]

In addition, it appeared that at least 439 phones had not been returned to their owners because they were said to be "unattributable" to any individual - and that the Home Office had not sent data breach letters to these people. [53] Mr Justice Lane declared that "[r]egardless of her present inability to link a phone to an individual, the defendant should have some idea of where these individuals went immediately after they left Tug Haven, albeit this may not be where an individual is currently living. If informed about the judgment, such an individual may be able to establish a claim to one of the retained phones, or at least advance a case that they had a phone that was seized by the defendant. Similarly, those who passed through Tug Haven and who were searched without any phone being found on them have a legitimate reason to be informed." [56]

The Court therefore ordered that:

(1) in the period 1 April 2020 to 22 November 2020 (inclusive), where the mobile phone policy has been applied to an individual; and

(2) in the period 23 November 2020 to the date of this Order, where section 48 of the Immigration Act 2016 has been relied upon as the legal basis to seize a mobile phone from a migrant who has arrived in the UK by small boat,

the Defendant shall use all reasonable endeavours to bring to the attention of each person (whether by letter, email, text or message or to known addresses or numbers or otherwise) whom the Defendant believes was subject to a search and / or seizure of a mobile phone, in writing: (i) the Judgment; (ii) this Order; (iii) the statement: “If you have not taken legal advice on your position, you are strongly advised to do so now”.

The Home Office was therefore compelled to write to the hundreds of individuals who arrived by small boat and whose phones may have been seized from them, to give them the opportunity to make a claim for remedies. It was also required to publish the order on the government's website for at least 12 months.