Over 10,000 people were referred to the Prevent programme between October 2024 to September 2025, according to the government’s latest figures. This is an alarming increase of almost 40% compared to the previous year, reportedly due to a rise in referrals following the Southport attack in July 2024. As usual, the majority of those referred were under 18, with almost 400 children under 10s being referred to the counterterrorism programme. The release of these figures raise more questions than they answer:

The surveillance behind the figures

Police-Led Partnerships

Following the conclusion of an internal HR process, the Information Commissioner is on garden leave, before his final exit. As reported in the Times, the investigation into his behaviour found “sexual harrasment, bullying and discrimination”. The Secretary of State, Liz Kendall, said she had “seen evidence of the vulgar and highly sexualised language that was used in his interactions with his staff and am extremely concerned that he continues to describe these incidents as misplaced humour”.

The government have now determined to carry out, jointly with the ICO, an independent review, but questions remain about how such behaviour was kept in the dark for so long. The competition to select the new Information Commissioner is expected to be published shortly, and the government is also expected to appoint the new non-executive members, as the ICO transforms to an Information Commission.

Deeper problems

While this affair is appalling, it cannot become an excuse to overshadow the deeper issues surrounding the ICO and its regulatory function. The fish may be smelling from its head, but it must be reckoned that the whole institution is suffering from deep problems, especially around its timidity in enforcing data protection law, which existed in similar forms during the last Commissioner’s tenure, and long beforehand.

As pointed out by a previous letter, convened by ORG and supported by over 70 experts, the ICO is experiencing a collapse in enforcement action. Data protection is a key instrument to regulate Artificial Intelligence and promote online safety, children protection, workers’ rights, and public service delivery. More and more evidence shows that, without proper regulation and policing of data practices, harms ensue, public trust erodes, and markets fail. Technology is a layer that spreads across all areas of society, and what may look as abstract issues such as data protection can easily undercut government ambitions where it matters.

As the new government moves in, selecting a new Commissioner cannot become a convenient exit door for sweeping the ICO under the proverbial rug. A change of leadership can, however, become a first step to fix the ICO, and bring about meaningful change.

OVERSIGHT MELTDOWN AND THE PUBLIC SERVICE DELIVERY

In 2022, the Ministry of Defence (MoD) leaked sensitive personal data of 18,700 Afghan nationals who had assisted UK forces, and up to 100.000 of their family members. At least “49 relatives or colleagues of affected Afghans have been killed in incidents linked to Taliban reprisals following the leak”, and a “survey of those notified found that 87% had received direct threats to their safety”. The ICO, however, their new “public sector approach” and left the MoD off the hook. First, by reducing a monetary penalty against the MoD. Then, by refusing to take any further action after the repeated nature of the Afghan data breach was revealed.

In 2025, 19 civil society organisations complained to the ICO, asking to take action against endemic data security incidents that have affected the eVisa scheme since 2020. A FOI response revealed that the ICO had already received 851 complaints against the Home Office. The ICO have taken no remedial action to this date, but they have adopted a new complaints handling policy, formalising an approach under which most complaints will be shelved away “for information purposes only”.

In 2025, HMRC carried out a data-driven crackdown on child-benefits, using travel data to suspend payments of recipients deemed to be residing abroad. As a result, 15.000 families were unjustly targeted and accused of fraud. The pilot scheme, which presented obvious red flags, was approved during a DEA Review Board meeting, in the presence of ICO staff. The ICO recently signed a Memorandum of Understanding with the government, promising to adopt a less oppositional stance toward the government.

These examples reveal how the ICO failings are closely linked to its policy choices, and have enabled malpractices to thrive within the public sector. Following the ICO new approach, complaints against public sector bodies have soared, the government were left unchallenged when opposition and accountability was needed. As Dame Chi Onwurah, Chair of the Science, Innovation and Technology (SIT) Select Committee, pointed out, “the use of technology to help grow the economy and improve public services requires the public to trust that their data is being kept secure”. The ICO failure to hold public bodies to account and drive up data protection standards has become a systemic risk that affects these bodies’ ability to carry out their tasks in a safe and effective manner.

ICO GUTTING WORKERS’ RIGHTS

Algorithmic management systems and Artificial Intelligence (Automated Decision-Making, or ADM) are exposing workers to heightened risks of discrimination and wage-theft, hidden under opaque algorithms. These issues are not new to the ICO: their report on the use of ADM in recruitment has concluded “that employers have more work to do to ensure that the use of automated recruitment tools respects people’s information rights”. According to their audit report, the ICO made “almost 300 recommendations to improve compliance”. However, the ICO have taken no enforcement action to remedy the infringement of workers’ rights they found in their audit.

On top of that, workers have successfully challenge discriminatory robo-firings and wage-theft with their right not to be subject to solely automated decision-making, as enshrined in the UK data protection law. When Boris Johnson’s government proposed to remove such right, the ICO lashed against it, and made the counter-proposal to expand such protections “to also cover partly automated decisions”. This critical stance, adopted under the previous Information Commissioner, was quickly shelved after John Edwards took over. The Conservatives’ proposal to gut ADM rights survived the change of government and became law with the Data (Use and Access) Act. As a result, workers in the UK lost the right not to be subject to ADM in most circumstances.

PROTECTING CHILDREN AND ONLINE SAFETY

Protecting children online, tackling online harms and curbing the spread of disinformation are hot political topics. The UK government has signalled the intention to restrict children’s access to social media, a move that would expand existing requirements to age-gate internet services. At the same time, the SIT Committee’s recent report on social media harms identified data-driven recommendation systems and online advertising as major drivers of online harms. Before then, the government has been running the Online Advertising Taskforce with the aim of addressing “illegal harms and the protection of children in relation to online advertising”.

However, the ICO has been pushing for the adoption of age verification systems at all costs and, notably, at the expense of privacy. This does not only risk undermining trust in age assurance policies, but represents an overly-narrow approach to regulation that fails to address the exploitation of personal data which, from age verification, are being repurposed to target online advertising. In turn, advertising data is used to drive up engagement, exploit addictions, and target harmful content.

On top of that, seven years ago the ICO published an update adtech report acknowledging widespread unlawful practices in the sector. As their recent advice to DSIT on how to reform online advertising rules read, “many of the issues associated with RTB that we identified in 2019 still exist today”. The ability to target individuals based on personal data is what exposes problem gamblers to being targeted with ads that exploit their addiction. It allows exclusion from life-changing opportunities on the basis of someone’s gender, sexual preferences, ethnicity or other sensitive characteristics. It exposes children and those in a more vulnerable status to be targeted and taken advantage of.

Against this background, the ICO are shying away from taking regulatory action to address these issues, but they are instead proposing to lower legal protections against online tracking and profiling. Likewise, the ICO gave the green light to Meta to rely on consent or pay, against their own guidance and in stark contrast to the European Union, where Meta’s practice was deemed unlawful on the basis of equivalent data protection rules. Estimates have shown that, if consent or pay takes hold, “keeping your phone private could soon cost around € 8,815 a year”. Whereas privacy ought to be a right, lack of proper regulation of the digital economy risks turning it into a cost of living issue.

WHAT THE GOVERNMENT CAN DO

The upcoming government has signalled appetite to move beyond a laissez-fair approach to digital regulation, and toward a more direct intervention to ensure markets and the public sector deliver. The ICO have a role to play in materialising this vision, but the government will need to promote bold changes and learn from past mistakes. In particular, the previous government quickly moved in to politicise regulators’ work and appease US big business. As we have seen with the ICO, this approach is, ultimately, a recipe for failure: lacking sufficient arms length from the government, the ICO has been failing to properly supervise public bodies, allowing data malpractices to spread. Also, weak regulation around harmful advertising comes as a direct consequence of the commitments the ICO have taken with the government. The next government will need to reverse this pernicious direction of travel and restore the independence of the ICO. As proposed by Gordon Brown’s report, the government should consider transferring responsibility for the ICO to Parliament.

The meltdown of the ICO leadership underscores the need to restore integrity at the top. This goes beyond workplace behaviour: the ICO have a long track record of revolving doors, where senior staff and leadership members often end up working for the industries or companies they were meant to police. Establishing proper boundaries against corporate influence is necessary to preserve the integrity of the ICO regulatory action. As we have long advocated for, the UK could draw from the California Privacy Agency and introduce a stay-period during which senior ICO figures are prevented from accepting jobs from the organisations and sectors they regulated.

Finally, the ICO need an overhaul of its regulatory and enforcement posture. ORG and others have previously called on the SIT committee to open an inquiry to explore what these changes could be. In the meanwhile, there are some obvious, low-hanging fruits the new government can reach to. As we argue in our petition, the government needs to clarify that effective monitoring and enforcement of regulatory requirements are the main objective of the ICO, and should take precedence over other considerations. This should include a clear duty to investigate complaints, and to remedy non-compliant behaviour. Individuals should also be given a clear and functioning avenue to appeal against ICO decisions when they fall short of upholding their information rights.

The government have an opportunity ahead. By restoring effective oversight of data protection rule, they can set the stage for trustworthy public sector delivery, innovation that benefits workers, and a digital economy that works for the British public, not a bunch of US tech companies. It is now up to them to seize it.

Digital Privacy

Reset the ICO

Find Out More

Dear Secretary of State,

Protect children online without making the Internet less secure

Protecting children online is an objective we all share. The challenge is ensuring measures strengthen child safety without weakening the privacy and security millions of people rely on every day, including children.

As organisations committed to a safe, secure, and rights-respecting internet, we are concerned by suggestions that the Government restrict virtual private networks (VPNs). VPNs are cybersecurity tools. They help people protect personal information on public Wi-Fi, enable secure remote working, allow students to access education networks safely, and help small businesses protect their systems. VPNs are essential for human rights defenders and journalists, domestic abuse survivors, the LGBTQ+ community, and others at heightened risk online.

The evidence does not support assumptions that young people use VPNs to bypass age restrictions. Ofcom’s research found that only around 3% of children had used VPNs to access content meant for older audiences. Evidence from Australia shows children are much more likely to get around age checks by not being asked, giving false information, or even drawing on a moustache.

Restricting VPNs would undercut the security and privacy of millions, without making children safer. Age-gating VPNs would require everyone to surrender sensitive personal information simply to access tools designed to protect privacy. Blocking VPN traffic reliably is technically unfeasible, and risks blocking employers, schools and public authorities using VPNs from accessing parts of the web. This would push people away from compliant and reputable VPN providers toward unregulated, data-exploiting services that are harder to oversee, leaving them less secure.

The Government should focus on policy interventions that address the root causes of online harms: strong enforcement of platform obligations, better parental controls, investment in digital literacy, and safety- and privacy-by-design obligations.

Children deserve an Internet that is safe, private, and secure. Those objectives should reinforce one another, not come into conflict.

Yours sincerely,

• Amnesty International
• Big Brother Watch
• Defend Digital Me
• ExpressVPN
• Global Partners Digital
• Index on Censorship
• Internet Infrastructure Coalition
• Internet Society
• Internet Society UK
• lnternews
• IPVanish
• Liberty
• Mozilla
• Mullvad VPN
• Mysterium VPN
• NordVPN
• Open Rights Group
• Proton
• Reporters Without Borders
• Stop Killing Games
• Stop Killing Internet
• Surfshark
• Tuta
• VPN Trust Initiative

Dear Dame Chi Onwurah MP,

We are a coalition of 20 civil society groups and experts, active in the fields of immigration policy, data protection, and human rights. We wish to thank the Science, Innovation and Technology Select Committee for raising the issue of eVisa problems during a hearing on data security in government, held on 10 February, 2026.

Due to ongoing instability in the Home Office digital programme, eVisa holders face challenges accessing and proving their immigration status. In a letter sent on 27 November, 2025, we asked the Information Commissioner’s Office to intervene against the numerous infringements of UK data protection law that underpin the eVisa scheme.

Thus, we urge the Select Committee for Science Innovation and Technology to support the previous letter received by your Committee, and urge you to open an inquiry into the ICO oversight failures. 

Since its rollout, the eVisa scheme has been affected by glitches and data security issues. 

UK residents trying to prove their status with eVisas have been facing data entanglement issues- when personal data of an eVisa holder and another, unrelated third party end up being mixed up – as well as denial in accessing the service, generating proof of immigration status, or rectifying or updating incorrect or outdated personal data. As you have correctly pointed out in your intervention during the February 10 hearing, eVisa issues include  data breaches,  the integrity, availability and confidentiality of personal data. We also commend that the “operational and security problems relating to the eVisa system” were recognised in your Committee’s recent report on Digital ID. 

As a study by the3million has found, these issues are systemic and rooted in design and architectural choices. Further, data collected by the Report.it! platform shows that eVisa holders have been encountering these issues consistently over the past six years. 

However, the Home Office has refused to disclose how many of such incidents they recorded, or how many people have complained or sought assistance. We acknowledge that the Home Office has recognised that mistakes are being made and have indicated their intention to resolve them. Nevertheless, it is essential to understand the timescales involved, what transparency they intend to offer on systemic issues and in what forums, and whether they plan to publish a roadmap against which the Select Committee could hold them to account. 

We identified and listed numerous failures to comply with UK data protection law by the Home Office. These include failures to adhere to baseline data protection principles, or to conduct and publish Data Protection Impact Assessments (DIPAs) before rollout and throughout the eVisa lifecycle. In light of the above, we also urged the Information Commissioner to open an investigation.

Indeed, we were not the first to raise such issues with the ICO. The press reported that, following a complaint made by a member of the public, the ICO had already determined in June 2025 that the Home Office breached UK data protection law. That complaint was not an isolated case: as disclosed in response to a Freedom of Information request, the ICO received 851 complaints against the Home Office only within the last two years. The volume of complaints against the Home Office is so significant that the ICO would exceed the cost threshold of the FOIA regime if they were to review and identify which complaints relate specifically to eVisa failures. Against this background, the Information Commissioner’s Office is yet to take any action to remedy eVisa data protection infringements. 

Unfortunately, this follows a pattern that emerged within the evidence discussed in your inquiry into data security in government. As your committee has heard during the February 10 hearing, the government is still working on implementing the recommendations from the Information Security Review, which should have been implemented in full by the end of 2024. Despite these delays, and the very consequential incidents that followed, the ICO has yet to take action, and have so far only sent a letter to “urge” the government to move faster.

While the ICO delays action to remedy these issues, it is eVisa holders who pay the price. 

As the “Exclusion by design” report shows, eVisa failures prevent individuals from proving their status when they need it to enter the country, from applying for jobs or getting a pay rise, from o enrollingin education, from claiming benefits. The human price of non-compliance is high and unjustifiable: UK data protection law already provides for rules that ought to prevent these harms from occurring. It also gives the ICO the role to remedy such infringements and hold public authorities like the Home Office to account.

In fact, the Administrative Court found, in their recent judgement, that the Home Office is able to fix eVisa failures when sufficient pressure is applied. The ICO is the authority with the statutory powers and the Parliamentary mandate to apply such pressure. Further, Parliament has also given individuals the power to raise complaints to the ICO for free, and to seek remedial action without the costs and procedural burdens associated with Judicial Reviews.

There is a risk of reduced scrutiny towards public bodies and diminished responsiveness to public complaints by the ICO.

The ICO has recently signed a memorandum of understanding with the government which was described, by government officials, as a shift away from a relationship of opposition to a relationship of partnership. Likewise, the ICO adopted a new complaints policy, according to which individual complaints would be routinely disregarded unless they reach an unspecified numeric threshold.

As the Home Affairs Select Committee have pointed out in their recent report about digital identity, restoring public trust and ensuring strong safeguards are necessary to deliver digital identity schemes. As the issues surrounding the eVisa scheme demonstrate, these important recommendations risk remaining unmet insofar as the ICO refrains from holding the government to account, to intervene when they get it wrong, and to protect the public from harm.

In light of the above, we urge the Select Committee for Science, Innovation and Technology to:

• Open a comprehensive inquiry into the Information Commissioner’s Office and their failure to carry out their oversight duties under the law.
• Investigate what institutional changes are needed to strengthen the ICO ability to oversee the government and other public bodies, also to support the implementation of the recommendations of the Home Affairs Committee’s Report on digital identity.
• Further investigate eVisa data practices, governance and failures, to inform the broader inquiry into data security in government.
• Ask the Home Office to disclose the data they hold concerning the amount of data security incidents, complaints and requests for support they received from the public in relation to the eVisa scheme. We note that on 1 July, the Home Office published error correction volumes from the online webform, but this does not show the volume of requests for support.

Signatures:

BARAC UK
ILPA
Imkaan
Liverpool Advocates For Windrush (LAW)
Medact
Middle Eastern Women and Society Organisation (MEW)
Migrant Democracy Project
Migrant Voice
Migrants’ Rights Network
No Borders in Climate Justice
Open Rights Group
POMOC
Reunite Families UK
Reset Communities for Refugees
Sherrards Solicitors LLP
South East and East Asian Women’s Association
Status Now 4 All
Steve Newman
the3million
The William Gomes Podcast

Digital Privacy

Stop the e-Visa scandal

Find Out More

20 immigration, data protection, and human rights organisations have asked the Chair of the Science, Innovation and Technology Select Committee to investigate the Information Commissioner’s Office’s failure to uphold data protection law in relation to the Home Office’s eVisa scheme.

In their letter to Dame Chi Onwurah MP, they have also called on the Committee to examine the eVisa scheme as part of its inquiry into government data security. They are also urging the Committee to require that the Home Office is transparent about the number of data security incidents and public complaints in relation to the scheme, and to set out how and when these issues will be addressed.

Data protection failings of the eVisa scheme

The eVisa scheme, has been plagued by widely known problems during the six years since it was first rolled out in 2020. People trying to prove their immigration status have reported mistakes in the Home Office’s records, while in some cases personal data has been incorrectly linked to others’ accounts. Many people have faced substantial difficulties in correcting these errors, leaving some unable to access their accounts or show their right to be in the UK.

These failures have had serious consequences. People have been prevented from proving their right to enter the UK, secure jobs, enrol in colleges, or access essential benefits and services. ORG heard of one man who was made homeless as the result of a data error in his eVisa. The ongoing problems with the scheme mean continued uncertainty for many people.

In November 2025, ORG and 18 other civil society organisations called on the ICO to open an investigation into the data protection breaches and accessibility issues arising as a result of the eVisa scheme. Seven months later, the ICO has failed to take any remedial action to address these infrigements. However, it did reveal in an FOI response, that they had already received 851 complaints about the Home Office as a whole between Dec 2023 and December 2025. The volume of complaints was so significant, the ICO was unable to identify how many were about the eVisa scheme specifically.

The need for institutional change at the ICO

The signatories are now calling on the Select Committee to investigate and get answers. However, they recognise that these failings are not just in relation to the eVisa scheme but a wider issue with the ICO’s enforcement. They are also calling for the Committee to investigate “what institutional changes are needed to strengthen the ICO ability to oversee the government and other public bodies, also to support the implementation of the recommendations of the Home Affairs Committee’s Report on digital identity”.

Following John Edwards’ resignation as Information Commissioner last week, Open Rights Group has called on the Government to “appoint a regulator with teeth, and reset the regulators’ approach of providing data protection in name only”.

Mariano delli Santi, Legal and Policy Officer at the Open Rights Group, has said:

“The ICO’s reasoning that it cannot be transparent about complaints relating to eVisas because there are simply too many Home Office complaints to review points to a government department and data regulator that are failing the public on many levels.”

“The ICO has a new policy, where complaints are logged for information purposes only, and action only taken if the volume of complaints against an organisation becomes substantial. The facts, however, speak for themselves: the ICO is ignoring the public’s complaints regardless of their volume. As the ICO’s FOI response revealed, they don’t even keep track of what you are complaining about.”

“We urge the Select Committee to take action to help those who have been impacted by data breaches but also to ensure that steps are taken so that data protection is taken seriously by the Home Office and upheld by the ICO.”

Digital Privacy

Stop the e-Visa scandal

Find Out More

The Supreme Court held that President of the United States can remove members of public offices at will. The judgment overturns well-established case-law that protected the independence of federal agencies, and has serious consequences for personal data transfers, digital rights, and the digital economy at large.

Personal data transfers between the EU and the US are made possible by the EU-US Data Privacy Framework (EU-US DPF), under which the US committed to protect personal data transferred to the US from its mass surveillance programmes. Data flows between the UK and the US depend on this scheme as well. The oversight of the framework rested on a number of US federal agencies, whose independence has now been gutted by the Supreme Court ruling.

The practical implications of this judgment are hard to understate for a country such as the UK, whose government and digital economy are highly dependent on US tech firms. It doesn’t only undermine the EU-US DPF, whose judicial invalidation is now guaranteed. US federal agencies have become structurally unable to act as meaningful legal guardians, making any future agreement with the US unworkable. Short-term fixes that were relied on in previous crises, such as Standard Contractual Clauses, would now prove ineffective: contracts are no solution against arbitrary State power, and there is no realistic prospect of a structural agreement being reached.

Likewise, the UK has recently reformed its data protection law to, potentially, allow personal data transfers to take place even if such protections are missing. If the UK were to pursue this path, however, it would lose adequacy status with the EU, and the consequences would be dramatic. In 2020, it was estimated “that the aggregate cost to UK firms of no adequacy decision would likely be between £1 billion and £1.6 billion” in legal and compliance costs alone. This does not account for the impact loss of adequacy would have on the EU-UK Trade and Cooperation Agreement, nor for its incompatibility with the non-diminution principle which Northern Ireland enjoys under the Good Friday Agreement and the Windsor Framework.

Hard truths require real solutions. The UK needs to depart from the failed path of technological dependency from the US and appeasement to US corporate interests. The new Labour leadership will have a difficult task at hand: charting a clear roadmap to digital sovereignty.

The Supreme Court Judgment Explained

In 2025, the Trump administration proceeded to replace democratic-affiliated members of several federal agencies with their own political allies. This purge reached both the US Federal Trade Commission (FTC) and the Privacy and Civil Liberties Oversight Board (PCLOB). Rebecca Slaughter, one of the FTC members who were fired, sued the US government, on the basis of well-established case-law that protected the independence of federal agencies. The case reached the US Supreme Court, which overturned such precedents and gave the President unfettered power to remove officials from public offices.

In the words of the US Office for Legal Counsel, independence is a means to “maintaining the separation of powers”, and a shield against legal decisions being reflective of partisan political agenda rather than the preservation of Justice. Sonia Sotomayor, a dissenting Justice within the Supreme Court, pointed out that the unfettered Presidential authority handed over by this judgment will “destroy the structure of government and […] take away from Congress its ability to protect” independent agencies. She continued by noting that, even under colonial rule, “Neither the king, nor parliament nor prime ministers in England at the time of the founding [of the United States] ever had an unqualified removal power”.

Thus, the Supreme Court has just undermined the integrity of the US regulatory environment as a whole. Tech companies who are based or operate in the US are now exposed to a new reality, where their legal obligations can be manipulated arbitrarily by the US administration.

A Death Warrant for Data Transfers to the US

Transfers of personal data to the US are at the centre of a decades-long legal controversy over the impact of US mass surveillance programmes on the security of European personal data. In 2022, the Biden administration signed an Executive Order that established a mechanism to protect personal data transfers to the US, and restrictions to the President’s authority to conduct surveillance programmes. This was the culmination of a long political process, started with the Data Free Flow with Trust initiative and the OECD declaration on government access to data, which sought to create baseline rule of law safeguards for the secure transfer of personal data among democratic countries.

On the basis of these commitments, the European Commission adopted the an adequacy decision for the so-called EU-US Data Privacy Framework (EU-US DPF), which legalises transfers of personal data between the EU and the US. However, the oversight of this framework rested on the FTC, the PCLOB, and the Data Protection Review Court. Article 8 of the Charter of Fundamental Rights of the EU requires oversight to be independent, to protect the overseers’ ability to enforce legal standards. By empowering the Trump administration to remove their members at will, the US Supreme Court undermined oversight, and thus the workability of the framework as a whole.

Max Schrems, a renowned privacy activist, has already pointed out that the invalidation of the US adequacy decision is not a matter of if but when, and called “on the European Commission to orderly withdraw the adequacy decision on the US”. Max Schrems already obtained the judicial invalidation of the previous US adequacy decisions twice, and the letter states that he is ready to seek a third judicial invalidation if the Commission does not act.

The UK is in a Tough Spot

In the UK, transfers of personal data to and from the US are underpinned by a so-called UK extension of the EU-US DPF: if or when the EU framework goes down, the “UK extension” will follow, making transfers of personal data to the US unlawful. To cope with the disruption this will cause, there are a few “easy fixes” that organisations and the UK government may try to pursue. Such options would, at best, be short-sighted and inadequate responses to the upcoming crisis. At worst, they would risk invalidating the UK adequacy decision.

UK organisations may try to rely on alternative mechanisms, such as Standard Contractual Clauses, that allow international data transfers to countries that lack acceptable data protection standards. However, the Schrems II judgment has already established that contractual arrangements are useless against US surveillance powers, and thus inadequate in this instance. This would leave UK organisations with the option to rely on encryption and key management. This is a technically-complex workaround that may work for some, but will be unfeasible for many.

The UK government could be tempted to use the new powers, introduced by the Data Use and Access Act (DUAA) 2025, to re-legalise transfers to the US. Contrary to the EU GDPR, the new UK international data transfers regime allows the Secretary of State to authorise personal data transfers to country that do not have independent or judicial oversight of data protection rules. Also, the DUAA lowered the standards that alternative transfer mechanisms, such as contractual clauses, need to reach in order to adequately protect personal data abroad.

If, however, the UK government were to take this path, the UK’s own adequacy decision would face repeal or judicial invalidation. The European Data Protection Board has already pointed out that adequacy “cannot be interpreted as not including the need for an independent supervisory authority and effective and enforceable data subjects’ rights”. Likewise, the UK adequacy decision sits on the commitment, made by UK authorities, to abide by these norms even if not listed in UK law. Notably, UK adequacy also establishes an unprecedented monitoring mechanism, where the Commission could require UK authorities to address any developments that undermine the level of protection afforded to EU personal data within three months – or else, face the repeal, suspension or amendment of the UK adequacy determination.

We need UK Digital Sovereignty

As it turns out, the General Data Protection Regulation deems transfers to the US to be unsafe not because of legal abstractions. It does, instead, capture the unsafe nature of these data transfers, and the high risk posed by technological infrastructure that can be weaponised by an unaccountable government.

The United Kingdom is highly dependent on US technology products and services. Its Invest2035 strategy has been centred around attracting foreign investments and firms. Its AI opportunities action plan encourages fast and loose adoption of AI products by the public sector, and heavy reliance on private (and, often, US based) companies for access to computing power. Peter Mandelson’s Tech Prosperity Deal aims to make the United States the principal technology partner for the UK.

This status quo now sits within the harsh reality that emerges from the US and its collapsing institutional environment, bringing up tough questions. How do you trust a “partner” which systematically evades constitutional check and balances? How reliable are US tech companies and service providers, when regulatory standards and contractual agreements have lost their meaning and enforceability? What will you do when you end up being locked you out of your email account or AI service, due to petty political motives pursued by the US administration of the day?

With ORG’s digital sovereignty report, we detailed how the UK needs a roadmap to de-risk its technological dependency: we must embrace open source and digital commons; strengthen competition and regulation in digital markets; and foster relationships with like-minded partners like the EU. The upcoming new Labour leadership will need to lay out a clear pathway to achieve this.

Demand UK Digital Sovereignty

Find Out More

The use of AI in asylum decisions is meant – according to the Home Office – to save time and money. But it is likely to be doing the opposite.

The use of AI in asylum decision-making

As the United Nations Refugee Agency recently noted, the UK’s asylum application system is under a great deal of stress. Staff morale is low, staff turnover is high, and there is a significant backlog of applications. In order to remedy the situation, the Home Office has introduced time targets (see 9.15) to speed up applications, and introduced the use of AI to create summaries of country information and of substantive interviews with asylum applicants. Just yesterday, the Independent Chief Inspector of Borders and Immigration reported that quantity was triumphing over quality, and showed deep problems with recruitment and training of asylum decision makers.

Our recent legal opinion argued that the use of AI is likely unlawful, especially as asylum applicants are not told about the use of AI in their applications. The problems with using AI is that summaries are likely to contain errors and miss critical information. It is also wholly possible that the case officer does not spend sufficient time engaging with the material. Producing a summary is not done for record keeping alone, but also as a means for the officer to order their thinking, so that they are confident in their decision.

The negative impact of time targets on staff morale is well documented. Layering time targets, AI summaries, poor morale and staff turnover, is an organisationally toxic mix. Furthermore, it pushes decisions into appeals systems, which is itself very expensive, and causes other costs to rise as people seeking asylum are prevented from working and must remain on benefits while a decision is reached.

Systems thinking in the UK asylum system

Thankfully, the government Office for Science has produced an excellent guide for unravelling complex, multi-department problems of this nature, with An introductory systems thinking toolkit for civil servants. This provides very useful mapping tools for policy problems of this nature. We have used one of the visual tools for systems mapping here, to describe the asylum application process.

This graph describes our view of how the different components of the current asylum system work together. We sketch out these inter-relationships:

• The use of AI summaries and time targets drives speed up, but reduces the quality of decisions

• The human toll on asylum applicants, who are the most vulnerable in the process, will itself be a demoralising factor for Home Office staff, if they are not allowed to treat them fairly

• Demoralised staff leave, further eroding the quality of decision-making

• The financial costs of waiting for asylum claims to be processed are also a human cost to those whose lives are put on hold, and placed in marginal conditions with limited support

Caught in a doom-loop

The asylum processing system is currently fixed in a doom-loop, where quality and efficiency keep falling. Yet fixing the incentives would be quite easy. The system needs to focus on capacity and the quality of the decision, rather than the speed. With greater capacity, if good decisions are made, the backlog could be reduced, staff retained, and the burden on the courts can be reduced. Rather than inducing highly costly “failure demand” placed on the courts, money spent on getting the decisions right at the start would save the system overall.

Unfortunately, the reason the government is averse to this may be as simple as not wanting to make the wrong “permissive” decision. Or perhaps they do not want to be seen to be allowing a greater proportion of successful claims.

Politically, it has been easier for the Home Office to place the responsibility on the courts. However, this is causing a different kind of political pain as it leads to a higher demand for subsidised accommodation, which has become the target of far right campaigning and violence. Worse, the Home Office responds to this by suggesting the use of military barracks, or other highly unsuitable ‘solutions’ to a problem it has created. And if courts make decisions the Home Office does not like, or admits more people than it would like, then the Home Office is unhappy.

The Home Office responds with more command and control

This desire to control all aspects of the process appears to explain the current proposal to add a new tier to the decision-making process, to replace the current independent Tribunal. As the new appeals process would be within the Home Office, it would be subject to the same political and institutional pressures to reject claimants. The Home Office intends to recruit ex-officers and other non-judicial people that it feels are likely to produce the desired results.

The Home Office’s desire for speed and control is likely to reproduce the same pressure for targets and use of unsuitable AI tools, which may well drive the same problems of lowering quality and sapping morale. Furthermore, the new process is designed to make challenging the decision at court much harder, by introducing judicial review as the standard, which is extremely difficult to challenge. For example, under Judicial Review, decisions are not challenged for being wrong, but incorrectly administered, or “so outrageous in its defiance of logic or of accepted moral standards that no sensible person who had applied his mind to the question could have arrived at it”. This is likely to reproduce conflict in the courts, as groups attempt to address the manifest unfairness of a purely administrative decision-making process. As unfair decisions may stand, the morale of the staff within the new Home Office appeals system may be further sapped. Most people want to believe that they are doing a good job and are helping rather than harming.

In order to address the fraught issue of the costs of the broken asylum process, the Home Office proposes at least some of these should be recouped from successful asylum seekers. That is, the Home Office seeks to charge asylum seekers for the costs of its own failures.

There is a better way forward

But there is another, better solution available. If the Home Office doesn’t want to make the decisions, but does want good administrative decisions, done at a reasonable speed, then it could give the whole process to someone else. In many countries, it is local councils that process asylum claims. In the UK context, a mix of councils, Wales, Northern Ireland and Scotland, and other devolved administrations, could be given these duties. It could invest in capacity to make good decisions, and ensure that decisions allocated resources to difficult cases, and measured success in terms of lower numbers of successful appeals at court.

It is clear that the Home Office could address problems with first stage applications pretty easily, simply by shifting the goal of the system from speed of processing to accuracy and fairness of processing, and applying appropriate resources. This would remove huge emotional costs to people seeking asylum, and to Home Office staff, while also massively reducing financial costs to the government.

However, instead of fixing the problem, the government is choosing to rig the system in favour of the Home Office’s preferred outcomes, by limiting the appeals system in order to reduce the numbers of successful appeals, and by loading some of the financial costs onto the people obliged to use the system. The initial decision process stays in place, broken and unfixed. The risks to asylum seekers from bad decisions, and to society at large of tolerating government bodging legal processes, towards particular unfair outcomes, is nowhere in sight. The same incentives for target-driven processes, AI for supposed efficiency, and failure are left in place and made worse. A worse way of addressing the problems the Home Office has generated would be hard to find.

Digital Privacy

Migrant Digital Justice

Find Out More

Andy Burnham’s likely succession to lead the current Labour government gives him the chance to reset digital policy. There is a lot to be gained from a new approach. Here is our advice to him and the Labour party about where they can make changes which would benefit the UK, our democracy and our economy.

Reset the digital economy

Let’s take Burnham’s start point that he wants to “end 40 years of neo-liberalism”, which he says has “siphoned wealth” out of northern communities, citing disasters such as rail and water privatisation.

This process of siphoning wealth from government and the economy is nowhere more alive than the digital sector. This is well-understood on the left and the right of politics. The last Conservative administration attempted to address deep dysfunction with IT providers to the state, in a series of policies starting with the creation of Government Digital Services, and including a failed attempt in 2016 to remove Capgemini, Fujitsu and BT from the Aspire contract that delivers the back end of the UK’s tax system. Contracts for these services currently extend to 2027.

There is a consensus that AWS and Microsoft have been ripping off both British businesses and the government to the tune of hundreds of millions of inflated cloud charges, according to investigations by the Competition and Markets Authority (CMA).

The difficulty of taxing companies like Amazon and Uber is also well understood. There is widespread knowledge that US multinationals are using tax efficiency measures to ensure that they do not pay their way towards the maintenance of basic state functions. Such companies, many of them being tech giants, now occupy a very large part of our economy, as detailed in Vassal State; whose author, Angus Hanton, can hardly be accused of being a radical leftist.

At this basic level, the idea of pursuing greater digital sovereignty, and building the UK’s domestic tech sector, especially through choosing open source state infrastructure, is a plain easy win. The ideas do not belong to the left or the right, they are simply necessary to avoid depletion of the UK’s state and economy.

Reset digital sovereignty

Governments of left and right across the EU are building back their state capacity to supervise and build software systems that they own and control. By using open source, they share resources, just like the tech giants do. By ensuring state leadership, through internal experts such as ZenDis in Germany, or DINUM in France, the state is able to manage contractors and own what they build, rather than allowing consultancies to be the experts and contractors owning software systems.

Companies like Palantir are a disaster from the perspective of autonomy and sovereignty. They aim to own the infrastructure and control government systems. Contracts with Palantir should be exited as fast as possible, as happened recently with the Ministry for Housing, Communities and Local Government, which developed their own open source replacement system for supporting Ukrainian refugees, noting that:

“We delivered Share on time in September 2025 and exited our contract with our supplier. Moving to this in-house model is already saving MHCLG millions of pounds a year in running costs”.

The NHS should be given the capacity to manage federated data systems itself. There are already multiple open source products that federate data for governments, and Manchester’s NHS have delivered their own federated data system for their region. That’s Manchesterism in action. This is not an impossible task.

Reset the regulators

The Starmer government had taken the view that to attract billions of US investment in data centres and AI, they should hold back the regulators. The ICO was given duties to balance rights and business growth, while the CMA was given a “strategic steer” to avoid doing things that could dissuade monopolists from investing. That is, to go easy on market abuse.

The CMA could take action to reduce the payments Apple force on UK app developers, to reduce the fees that Microsoft force companies to pay when deploying their software on competitors’ cloud products, and to reduce or remove “egress” (data export) fees when switching cloud provider. UK business throughout the economy would benefit from CMA action to increase cloud competition and reduce excessive charges.

The ICO’s failure to regulate both the private sector and government has been disastrous for the most vulnerable in our society. We have been tracking the ICO’s work on eVisas, which is a scheme that keeps denying people access to services, jobs and even entry to the UK, despite people having the right to live and work in the UK. The ICO, as with many other problems at government, has not taken action.

Regulate Artificial Intelligence and ban predictive policing

The UK lacks safeguards for the use of AI. There is no legal framework that makes sure that public or private sector use of AI does not breach our human rights and dignity. Yet biased and inaccurate decisions are a natural feature of technologies that are statistical and correlative in nature.

Regulation of AI was a Labour manifesto pledge, which curiously disappeared in the face of lobbing and trade agreements with the US. But it remains necessary. As AI is increasingly used in benefits, policing and borders, government and society needs to know whether it is actually safe. Without a legal framework, government will continue to deploy ill-judged systems like employing AI in immigration decision summaries, expanding facial recognition and rolling out predictive policing tech that targets and criminalises whole communities. These are technologies that cause real harms to real people, in the name of alleged (rather expensive) efficiency.

Roll back the digital hostile environment

The Home Office’s approach of creating hostility to migrants has had a deep and lasting impact on UK politics. It has fuelled the politics of hate. As we discuss in a forthcoming report, borders and migration policy is being digitised in a manner which is dehumanising, and creates systemic rights violations, by treating the most vulnerable people as potential threats. These changes are fuelling an AI and border surveillance industry that is dependent on political hostility to migrants. Simultaneously, the UK’s foreign and climate policy risks increasing the instability that pushes people to migrate. The UK needs to take a holistic view of migration, and stop targeting refugees and migrants.

Ditch Digital ID

It is still unclear why digital ID is government policy, or what it would really deliver. Digital ID appears to have been promoted because of the personal desires of Tony Blair, combined with the illusion that it could help with evasion of work permits. In our view, Digital ID remains a solution in search of a problem, that threatens to poison the next Labour prime minister’s relationship with the public. Combined with AI, Digital ID could be used to limit access to public services and automate decisions using AI; a recipe for reinforcing systemic discrimination.

Change our online safety approach

There is a lot of understandable pressure within Labour to make the online world safer for children. There ought to be a bigger discussion about the concentration of informational power in social media tech giants and AI companies.

However, as we outlined in our blog, safety policies keep falling flat because they are working against the grain of the social media attention economy. So far, safety measures have punished users rather than big tech. An under 16s ban on access to social media illustrates this: it is children, rather than big tech, that will impacted by a ban.

We need to tackle the power of social media directly, by empowering users to control the information they receive, and by building pro-social social media, like BlueSky and Mastodon. As a first step, government and Labour politicians should publish to these networks, so that voters and residents are not forced to use X or Facebook to receive government social media updates.

Social media companies that are undermining UK democracy continue to be funded by the UK government, through advertising. The next administration should shift government advertising budgets to local news sites, rather than funding Meta and Google.

Show us your thinking

As noted in our Digital Sovereignty report and our blog discussion of social media policy, the UK government say they promote systemic policy analysis, to understand the complicated interactions that take place in difficult areas of policy, using ‘systems thinking’ and ‘futures thinking’. This is exactly what is needed, so that we can have grown up policy discussions. However, little of this work seems to reach the public domain. Government needs to set out its understanding and analysis of the digital policy landscape.

Difficult but worth it

There is no doubt that changes to digital policy and economics are difficult. However they are fundamental in the current political situation. Our suggestions do not require breaking manifesto commitments, but would contribute to a reset of the UK economy and society, in favour of the UK economy and better value in government spending, improving social balance and protecting our democracy.

Open Rights Group’s Executive Director Jim Killock said:

“John Edward’s departure is a chance for the Government to appoint a regulator with teeth, and reset the regulators’ approach of providing data protection in name only.

“Parliament must ensure that the future Commission is run by professionals who want the law enforced, including against government data failures.”

“Edwards may now be offered jobs with Big Tech, the data industry and the very large legal firms who represent them, as many of his own senior staff and predecessors were. Edwards should set an example and refuse attractive salaries provided by this ‘revolving door’ – and the government should legislate to prevent this from happening so that the regulator is kept at arms length from Big Tech.”

Reset the ICO

Open Rights Group recently called for the ICO to be re-set after multiple failings while Edwards was at the helm. These included introducing the so-called public sector approach to enforcement, under which the ICO began to heavily rely on non-enforceable, written notices where the ICO point out that the law has been broken without taking any regulatory action to remedy an infringement or holding law-breakers to account.

As ORG’s alternative ICO annual report 2023-24 showed, reprimands lacked effectiveness and deterrence. The ICO’s own post-implementation review of the public sector approach would later reveal how the volume of complaints raised by UK residents about public sector organisations’ use of their data has increased substantially as a result.

Edwards failed to open an investigation into the Ministry of Defence following a data leak that reportedly, led to the death of at least 49 people in the aftermath of the Taliban’s takeover of Afghanistan. This decision led to a Parliamentary inquiry from the DSIT Select Committee, and an open letter from 70+ data protection experts lamenting a collapse in enforcement action. Dame Chi Onwurah, the Chair of the Committee, acknowledged the “institutional failure” that had led to the breach, which “raises serious questions for both the government and regulators like the ICO”.

Edwards was also supportive of the Government’s data protection reforms, which weakened the public’s rights and ability to have control over their personal data. The ICO was became the only regulator to fully support the government’s proposals despite concerns raised by the Equality and Human Rights Commission, the National Data Guardian, the Biometrics Commissioner, the Scottish Biometrics Commissioner, and the Northern Ireland Human Rights Commission.

Read The ICO isn’t doing its job – why the data watchdog needs to be reset.

Digital Privacy

Reset the ICO

Find Out More

The Home Office is using two AI tools in asylum casework which could be unlawful. The Asylum Case Summarisation (ACS) tool uses GPT-4o to summarise asylum interview transcripts, and the Asylum Policy Search (APS) tool is a GPT-4o chat-based interface used to search country policy documents.

Both generate new text rather than simply retrieve existing information, meaning they can filter or omit facts relevant to a caseworker’s decision. APS was fully rolled out in July 2025; ACS followed in April 2026.

In response to a parliamentary question tabled in April 2026, the Home Office subsequently confirmed it did not follow the UK AI Playbook principles – even though the February 2025 Playbook preceded the full rollout of both. (The Home Office referenced the ‘project pilots’ in their explanation.)

In March 2026, the Open Rights Group had already published a legal opinion which concluded that the AI tools are likely unlawful.

Using these tools creates several problems, which include:

1. No transparency. Applicants are not told AI is being used in their case. They cannot see or correct AI-generated summaries of their own interviews. Neither tool appears in the Algorithmic Transparency Recording Standard (ATRS) repository. The Home Office has also refused to disclose the ‘prompt’ used in ACS. See also this Home Office response.

2. No published assessments or guidance. No Data Protection Impact Assessment (DPIA), no Equality Impact Assessment (EIA), and no Standard Operating Procedure (SOP) has been published for either tool. Without an EIA, the Home Office cannot demonstrate compliance with the Public Sector Equality Duty.

3. Training is inadequate. The minister cited a generic ‘AI for all’ learning package, giving no detail on content, duration, or assessment. Case-specific procedural guidance is imperative.

4. Oversight is internal and reactive. The only oversight mechanism is a feedback inbox set up after APS was already deployed. Caseworkers are not required to verify AI outputs against the original source material, so the quality of oversight depends entirely on each individual.

4. ‘Human-in-the-loop’ is inadequate. Both tools generate the text a caseworker reads before making a decision, so they shape the information that is seen. Stipulating that a human signs off the final decision does not address this. Pilot evaluations found that 9% of ACS summaries were too flawed to use, and 23% of caseworkers lacked full confidence in the outputs.

We recommend that the Government:

1. Suspends both tools immediately. The full DPIAs and EIAs must be published. Tools must be registered in the ATRS repository.

2. Stipulates full transparency. The office of the Chief Inspector of Borders and Immigration should conduct an independent investigation. The Independent Advisory Group on Country Information should consider the use of AI for country of origin information summaries. Remedies for affected applicants must be implemented.

3. Mandates civil society consultation before any future deployment of AI in the asylum system, with findings published and independently reviewed. Any future iteration must come with comprehensive caseworker guidance.

SOAS ICOP Policy Briefings to Inform Government and Parliamentary Debates. By Sara Alsherif (Open Rights Group), with Sanjana Deen (SOAS University of London) (02 June 2026)

For further information, contact the author at sara@openrightsgroup.org/ 07902823294. Contact Professor Alison Scott-Baumann for access to other experts at as150@soas.ac.uk, and visit our website for more information. The views expressed in SOAS ICOP Briefings are those of the authors and do not necessarily represent those of SOAS University of London.

Digital Privacy

Migrant Digital Justice

Find Out More