The UK Home Office is under scrutiny over claims that it collected financial data on hundreds of thousands of British citizens during routine immigration checks. A report by credit reporting firm Equifax, mistakenly emailed to a charity in June 2024, contained personal details of more than 260 individuals unconnected to the immigration applicant, some dating back to 1986. The document was part of an immigration fee waiver application process requiring financial verification for applicants.
Head of campaigning at the Refugee and Migrant Forum of Essex and London (Ramfel), Nick Beales suggested the scale of data collection could be immense if one application included such a large number of third parties. Equifax, previously involved in a massive cybersecurity breach in 2017, stated that verifying the vast amount of information it holds was impractical. The company asserted its data is intended solely for private or in-house use.
Ramfel contacted the Home Office about the apparent breach, but initial inquiries went unanswered. A letter to Home Office permanent secretary Matthew Rycroft in November 2024 raised concerns over non-consensual data collection. The Home Office responded in December, stating that it complies with UK data protection laws and stores only the minimal necessary personal data, deleting anything deemed unnecessary.
Following public attention, the Home Office launched an internal investigation to determine if a data breach had occurred and confirmed that Equifax is no longer used for processing visa fee waivers. This issue arises amid a significant increase in fee waiver requests after the Conservative government raised the immigration health surcharge in February 2024. Applications surged from 13,600 in late 2023 to 25,600 in the third quarter of 2024, exacerbating processing delays.
Beales argued that additional financial checks on low-income applicants were unnecessary and suggested that eliminating them could speed up visa processing and prevent extensive data collection on uninvolved individuals. He emphasized that intrusive financial scrutiny is redundant for those already struggling financially and receiving government assistance.
Equifax, which provides services to several government agencies, including HM Revenue & Customs and the NHS, has faced regulatory penalties before. In 2023, it was fined £11 million by the Financial Conduct Authority for a data breach affecting nearly 14 million UK consumers. A Home Office spokesperson stated that any data breach is a serious concern and that measures are continually monitored to protect personal information.
