Visa applicants’ medical data wrongly sent to lawyers hired by employers

UK immigration lawyers say that they regularly receive confidential medical information meant for individuals whose work visa applications they handled, in an apparent breach of privacy rules that stretches back years.

The lawyers have received emails and text messages ranging from notifications of hospital appointments to messages about vaccinations and diagnostic tests, they said.

In one recent case, cancer test results were shared.

The lawyers suggest that this is occurring because the people in question have given their details to UK Visas & Immigration, part of the Home Office, as the point of contact for queries on a visa application. These details may then have been shared with other public sector bodies or recorded in a central database.

“Our email addresses are clearly flowing around the system . . . That shouldn’t be the case. It needs to be resolved,” said Nicolas Rollason, head of immigration at law firm Kingsley Napley.

The Home Office said it was unable to change contact data that was provided directly by visa applicants.

“We only transfer personal data to other departments where we have a lawful basis to do so,” it added.

The lawyers concerned are usually instructed by employers who are sponsoring a non-UK national for a skilled work visa.

The messages do not always directly reveal sensitive information, as extra details such as a date of birth can be required to open attachments. But some contained “quite personal data that maybe you don’t want to share with us, as we also act for the employer”, Rollason said.

The lawyers say they also have a duty of care and confidentiality to the individuals, but that there is potential for conflicts of interest to arise.

“I feel deeply uncomfortable . . . I am instructed for immigration advice,” said one lawyer who had seen messages arrive in her inbox for at least four years, and described it as “very much an ongoing issue”.

Although the emails she received did not contain the names of the intended recipients, two other lawyers said they had received messages that did name the people concerned, as well as containing information relating to their medical condition.

One lawyer received an NHS notification of a maternity appointment and said its intended recipient was “shocked” to learn where it had been sent.

Lawyers also said they had received correspondence from HM Revenue & Customs, including tax letters in brown envelopes.

HMRC said it could legally access Home Office systems to verify eligibility for child benefit, but that it had “no evidence that HMRC is using any contact details which were only provided to a Home Office system” or that it was incorrectly sending information on individuals to third parties.

Rollason and his colleagues have been receiving the misdirected messages for years, including several in the past six months. The emails and texts can arrive years after relationships with clients have ended, and when clients seek to update their contact details with UKVI it has no effect on other organisations’ records.

After being approached by the FT about the issue, the Immigration Law Practitioners’ Association wrote to the Home Office to raise concerns.

The privacy information notice that describes how the Home Office shares and uses visa applicants’ personal data does not indicate that contact details could be stored and used by third parties for purposes such as personal healthcare and tax correspondence.

It does say that the Home Office may use the data to keep in contact in relation to a visa application or follow-ups such as prompts for renewals.

It also notes “the right to object to and ask to restrict our use of your personal information, and to ask us to rectify or delete your personal data”.

The Home Office’s view is that it does not need to warn about what another organisation may do with the information, once it has shared it with them, although it is taking steps to prevent further leaks.

The department routinely shares data with HMRC and the NHS in relation to rights to access public services, as well as to enforce visa rules.

NHS England said that the contact details provided for visa applicants were used by the NHS to administer the Immigration Health Surcharge — an annual fee visa holders must pay — “and may also be used to send invitations for services such as vaccinations and screening”.

Anyone receiving misdirected correspondence should return it to the sender, NHS England said, adding that a patient’s address would also be updated on NHS systems when they registered at a GP practice.

The Information Commissioner’s Office said it was “the responsibility of data controllers to ensure all personal data held is necessary, proportionate and still required.”