UK Home Office eVisa scheme faces GDPR scrutiny over data errors

As outlined in The Register, civil society groups are urging the UK's data watchdog to investigate the Home Office's digital-only eVisa scheme for potential GDPR breaches. Concerns center on systemic data errors and design flaws that reportedly expose sensitive personal information and hinder migrants' ability to prove their legal status.

A joint letter to the Information Commissioner's Office (ICO), coordinated by the Open Rights Group, details alleged failures by the Home Office to meet data protection and equality obligations. The digital-only eVisa system replaces physical immigration status documents with a live online record. When this system malfunctions, individuals face exclusion from work, housing, travel, and education due to a lack of a meaningful fallback. Documented issues include a high volume of data errors, such as a Canadian citizen's personal details being wrongly disclosed to a Russian woman. Migrants have also been locked out of their eVisa accounts with inadequate support.

The complaint highlights criticisms of the Home Office's Data Protection Impact Assessment (DPIA), described as incomplete and misleading for failing to adequately address risks for vulnerable users and the implications of a digital-only system. Campaigners also challenge the "digital-by-default" framing, as the eVisa scheme lacks an opt-out, forcing reliance on others and introducing privacy risks. The ICO is now tasked with assessing whether the Home Office's paperless system complies with GDPR or is unfit for purpose, with broader implications for digital transformation in government services and data protection compliance.

Source: The Register