Dear Home Office,

I am writing to make a request for information under the Freedom of Information Act 2000 (“FOIA”).

I seek information relating to the Home Office’s Identify and Prioritise Immigration Cases (“IPIC”) Business Rules.

I hereby seek the following:

1. The latest DPIA performed in relation to the IPIC Business Rules, if later than 2021 (as disclosed in response to this request: https://www.whatdotheyknow.com/request/t...).

2. Confirmation as to whether the IPIC Business Rules are developed internally or through a third party service provider (and if the latter, confirmation of the identity of this service provider and a copy of any contract or agreement with them).

3. Confirmation as to whether the IPIC Business Rules are deployed in relation to applications for entry clearance and leave to remain under the Immigration Rules (please specify which applications, for example: asylum claims); decisions to impose removal directions, decisions to grant immigration bail, and decisions as to what bail conditions someone without immigration status should be subject to.

4. The information provided to a Home Office caseworker when the IPIC tool makes a particular “recommendation”.

5. The frequency and nature of the “ongoing reviews and testing” (mentioned at paragraph 5.3 of the 2021 DPIA) purportedly conducted by the Home Office to ensure that individuals are not incorrectly recommended for interventions. Please confirm whether all “recommendations” are subject to such reviews or just a randomly selected sample.

6. Copies of all training materials provided to caseworkers to ensure that they use IPIC correctly. This includes any training information provided to ensure that caseworkers comply with the Public Sector Equality Duty and their obligations under the UK GDPR and Data Protection Act 2018. I note that the previously disclosed EIA refers to such training (see paragraph 3a).

7. Confirmation as to what the “analytical purposes” referred to at page 5 of the 2021 DPIA are, and whether the input data used for such purposes is anonymised prior to being used for such purposes.

If our request requires any clarification please do not hesitate to contact us. We are willing to limit our request should that be necessary and kindly request you identify what would assist you in being able to respond. Thank you for your time and we look forward to your response.

Yours faithfully,

Privacy International

Dear Home Office,

Please pass this on to the person who conducts Freedom of Information reviews.

We are writing to request an internal review of Home Office's handling of our FOI request 'Identify and Prioritise Immigration Cases (“IPIC”) Business Rules used by the Home Office' (FOI2023/04608).

The initial request

We made our request on 18 October 2023 and received a substantive response on 3rd November 2023. Our FOI request sought information in relation to the Home Office’s Identify and Prioritise Immigration Cases (“IPIC”) Business Rules used to provide caseworkers with “recommendations” in respect of immigration decisions. In particular, we asked the Home Office to provide the following information:

1. The latest DPIA conducted in relation to the IPIC tool.

2. Confirmation as to whether the IPIC Business Rules are developed internally.

3. Confirmation as to whether the IPIC Business Rules are deployed in relation to a number of different immigration applications and decisions.

4. The information provided to the Home Office when the IPIC tool makes a particular “recommendation”.

5. The frequency and nature of reviews conducted to ensure that individuals are not incorrectly recommended for an intervention.

6. Training materials provided to caseworkers particularly with regard to ensuring compliance with the PSED and data protection laws.

7. Confirmation as to what the analytical purposes referred to in the 2021 DPIA are and whether the input data is anonymised prior to being used for this purpose.

The Home Office’s response

The Home Office addressed all questions, but failed and/or refused to provide either some or all information in respect of questions 1, 3, 4, 6, and 7:

1. Question 1: the Home Office enclosed a redacted version of the DPIA on the basis that disclosing a complete version would prejudice the operation of immigration controls further to section 31(1)(e) of the FOIA.

2. Question 3: the Home Office failed to provide confirmation as to whether the IPIC tool is used in relation to applications for entry clearance and leave to remain under the Immigration Rules; as well decisions relating to removal directions and immigration bail. This was on the basis that the tool is purportedly not used in relation to these decisions.

3. Question 4: The Home Office refused to disclose the information provided to a caseworker when the IPIC tool makes a particular recommendation on the basis that to do so would prejudice immigration control.

4. Question 6: The Home Office refused to provide the training materials on the basis that it would likewise prejudice immigration control.

5. Question 7: The Home Office failed to disclose the discrete and specific purposes of the analytical processing cited in the 2021 DPIA. Instead, the FOI response stated that: “analysis is conducted to drive improvements to workflow and inform policy and guidance”.

Review request

We request that you review the decision failing and/or refusing to provide disclosure in response to questions 1,3,4,6 and 7. We provide our supporting reasons in relation to each of these questions below:

In respect of question 1, we note that there are substantial redactions, which frustrate the very purpose of conducting and disclosing the DPIA. In summary, the Home Office redacts the definitions of the datasets that are relevant for the IPIC tool as well as linked DPIAs (page 8); 10 categories of personal data that are processed through the tool (page 9); the explanation as to how the tool will be able to meet data subject rights (page 13); the explanation as to the purpose of processing (page 16); and an explanation as to the legal and other significant affects that the profiling undertaken through the tool could have on the data subjects (page 20).

The public interest test conducted by the Home Office at Annex B of the FOI response correctly accepts that: “the public have an expectation in knowing how the Home Office utilises digital trial tools to ensure that they are used responsibly and in line with expectations.” The initial decision-maker also correctly accepted that an aspect of this would be disclosure of the DPIA.

However, the FOI response failed to provide adequate reasoning regarding the decision to maintain the exemption. The response simply states that providing the material requested would “prove useful to those who might seek to prejudice the operation of an effective immigration control”. As per ICO Decision Notice FS50286261 (available here: https://ico.org.uk/media/action-weve-tak…) the onus is on the public authority to explain how purported prejudice would arise and why it is likely to occur through disclosure. The response to the FOI would need to therefore explain why the extensive and disproportionate redactions would prove useful to individuals and groups seeking to evade immigration control. The response also states that further information by way of explanation would have to be disclosed if an unredacted DPIA were to be provided, which would itself compromise immigration control. This assertion is plainly without any merit given that the redacted version of the DPIA currently requires further explanation to properly fulfill the purpose of disclosing it (see below for more detail on this point). Moreover, were the Home Office to provide an unredacted DPIA there would be no legal obligation or procedure for it to provide such additional explanation.

For the avoidance of doubt, we do not accept that the public interest test against disclosure would be made out in the event that further reasoning was to be provided. The FOI response proceeds on an incorrect assumption that the only alternative is to either provide a wholly unredacted DPIA or the DPIA in its current form. By contrast, certain redactions such as in relation to access to data will be controlled as well as sensitive information regarding where the data will be stored (pages 11 and 12) may well be justified. But the approach has instead been to redact disproportionate sections of the DPIA that could not reasonably be used to circumvent immigration control. The response also recognises the transparency functions at the heart of carrying out and disclosing a DPIA, yet in its current form these are wholly frustrated. By way of an example, knowing the categories of data that are processed by the tool as well as the significant legal affects it can have on data subjects are fundamental to assessing whether the triage tool is being used responsibly and in line with the expectations of data subjects. We therefore request that the Home Office carry out the public interest test again and provide a version of the DPIA that does not redact the critical information outlined above.

In respect of question 3, it is clear that the IPIC tool is used in relation to a number of immigration applications and decisions. This was first revealed by the ICBI report ‘An inspection of the Home Office’s use of sanctions and penalties’ (https://assets.publishing.service.gov.uk...), which referred at footnote 190 to “triage tools” used “to assess the removability and level of harm posed by immigration offenders…" While we understand the Home Office’s position to be that the IPIC tool is only deployed to make “recommendations”, the plain everyday meaning of our question is broad enough to encompass “recommendations” in respect of certain decisions. It is therefore not tenable for the Home Office simply to deny that IPIC is being used in relation to these decisions and applications. As such, pursuant to the question, the relevant applications and decisions should be disclosed following the requested review.

In respect of question 4, the initial response similarly failed to provide sufficient reasoning as to why disclosing the information “provided to a Home Office caseworker when the IPIC tool makes a particular “recommendation”” would prejudice the operation of immigration control. In relation to the need to give adequate reasons for the assertion that (a) disclosure would prejudice immigration control and (b) that this outweighs the public interest in providing the information - we refer the reviewer to our submissions above.

We note that the response states that the Home Office would have to provide the exact information on the screens of caseworkers to answer this question. This is an erroneous and untenable assertion - the question requested the “information” provided by the tool when it makes a recommendation. This could be in multiple different forms, including for example an explanation in summary form as to the information provided if providing caseworkers’ screens could compromise immigration control. It is unclear how such an explanation could possibly “prove useful to those who might seek to prejudice the operation of effective immigration control”. And the fact that the FOI response did not even consider the possibility of a providing an explanation in summary form demonstrates that the public interest test carried out was defective. Finally, as with the data missing from the DPIA, this information is patently key to providing transparency regarding the use of digital triage tools, which the Home Office accepts is in the public interest. We therefore request that the Home Office carries out the public interest test again and provides the requested information.

In respect of question 6, we note that the FOI response failed to provide any training materials at all. We once again place reliance on the submission made out above that the Home Office has failed to provide adequate reasoning when carrying out the public interest test. The failure to consider disclosing a redacted version of the training materials similarly shows that the test has not been carried out correctly.

Finally, in respect of question 7 - we note that we requested the purpose(s) of processing triage data for analytical reasons. In accordance with the data protection principles under the UK GDPR, a processing purpose must be specific and explicit. Simply stating that the data will be used to drive improvements to workflow and inform policy and guidance is overly vague and does not constitute a purpose. Therefore, the Home Office will need to explain what improvements in workflow it seeks to engender through the processing. The same is true for the policies and guidance - the FOI response should have stated which policies and guidance (and if all of them this should have been specified).

Yours faithfully,

Privacy International

Dear Home Office,

Thank you for acknowledging receipt of our request for an internal review (case ref IR2023/06859) submitted on 19 December 2023. It has come to our attention that the link to ICO Decision Notice FS50286261 (referred to in our review request) does not work. We therefore attach a working link here: https://ico.org.uk/media/action-weve-tak....

The link was provided further to our submission that the Home Office failed to provide sufficient and clear reasoning as to why providing the information requested at questions 1,4, and 6 would prejudice the operation of immigration controls under section 31(1)(e) FOIA. By way of assistance, we refer the reviewer to paragraph 12 of the ICO Decision Notice (to which we have now provided the correct link). As per our review request, this states that the link between the information requested and any potential prejudice needs to be sufficiently made out and particularised.

In this regard, we also refer to the more recent ICO Decision Notice IC-56606-Z6W7 dated 1 June 2021 (https://ico.org.uk/media/action-weve-tak...) in which the ICO found that the Home Office could not maintain that requested material is self-evidently exempt and should provide "supporting evidence or penetrating analysis" as to why and how the information will impact the operation of immigration controls (paragraph 32).

Yours faithfully,

Privacy International

Dear Home Office,

We write further to our freedom of information request regarding the Identify and Prioritise Immigration Cases (“IPIC”) Business Rules used by the Home Office (case ref FOI2023/04608). We note that your substantive response to our internal review was due on 22 January 2024, which is now almost two months out of time. We therefore request that you provide your response as a matter of urgency and provide an update as to when we can expect to receive it.

Yours faithfully,

Privacy International

Dear IE PQs, FOIs and Correspondence,

Thank you for providing us with the documentation on 1 October 2024 further to our ICO complaint. We note that the following links/pdfs you provided do not appear to be working and as such we are not able to open them:

1. Annex D iii OFF SEN IPIC Reference Manual EUSS v01 REDACTED.pdf
2. Annex D iv OFF SEN ipic digital reporting manager training guide PDF REDACTED.pdf
3. Annex D vi OFF SEN IPIC CSTT Managers Training Guide v1 REDACTED.pdf
4. Annex D vii OFF SEN IPIC ROM Training Guide FINAL REDACTED.pdf
5. Annex D viii OFF SEN IPIC CSTT Training Guide Final v1 REDACTED.pdf
6. Annex D ix OFF SEN IPIC Detailed Reference Manual ISD REDACTED.pdf

Please could you provide us with working versions of the documents by way of reply. We may also send additional follow-ups in respect of any missing documentation once we have had the opportunity to substantively review the disclosure.

Yours sincerely,

Privacy International

Dear IE PQs, FOIs and Correspondence,

Many thanks for re-sending the above-mentioned documents.

We now have been able to access all but the final two documents you provided, i.e everything save for:

1. Annex D viii OFF SEN IPIC CSTT Training Guide Final v1 REDACTED.pdf
2. Annex D ix OFF SEN IPIC Detailed Reference Manual ISD REDACTED.pdf

Please could you re-send working versions of these two.

Yours sincerely,

Privacy International