Introduction and contact details

This document is the post-consultation report for the consultation paper, Biometric registration regulations: changes to the Code of Practice.

It will cover:

• the background to the consultation

• a summary of the consultation responses

• a detailed response to the specific questions raised in the report

• the conclusions and the next steps following this consultation.

Further copies of this report and the consultation paper can be obtained by contacting IdentitySecurityTeam@homeoffice.gov.uk

Alternative format versions of this publication can be requested from BiometricRegsCodesofPractice@homeoffice.gov.uk.

Complaints or comments

If you have any complaints or comments about the consultation process you should contact the Home Office at the above address.

Background

In 2018, we started to change the way we enable foreign nationals to evidence their status in the UK, by issuing them with digital forms of evidence instead of physical ones, such as passport stickers (vignettes) and biometric residence permits (BRP) and cards (BRC). At the end of 2024, we stopped issuing foreign nationals biometric residence permits and cards as evidence of their immigration status in the UK and instead provide them with evidence of their immigration status online, which they can view and share with third parties which will be in the form of an eVisa.

We plan to amend the Immigration (Biometric Registration) Regulations 2008 (the 2008 Regulations), so that most foreign nationals who are subject to immigration control and make a successful application to come to, or stay in the UK will be required to apply for a biometric immigration document (BID) and register their fingerprints and digital facial image^{[footnote 1]}.

Successful applicants who are given permission to stay will be issued with an eVisa as evidence of their immigration status and any entitlements in the UK, such as the right to work or access to public benefits and services. They will need to go online to Gov.UK and use the view and prove service, so they can evidence their status in the UK.

The power to set up the biometric immigration document scheme, under which eVisas will be issued, is from sections 5 to 15 of the UK Borders Act 2007 (the 2007 Act) and regulations made under it. These updated regulations will include new provisions for sanctions for non-compliance and a revised Code of Practice, which are intended to reflect the transition away from physical documents to digital ones. We intend to reflect this by creating measures that will encourage compliance and to only use the current measures in limited circumstances. A new sanction that will prevent status holders from sharing evidence of their status will be created, and primarily used where individuals fail to update their facial image at least once every 10-years, until they reach 70 years old.

The 2007 Act requires the Secretary of State to issue a Code of Practice about matters which the Secretary of State needs to consider when determining whether to issue a civil penalty notice, and how much the civil penalty should be. The 2007 Act requires the Secretary of State to publish proposals; consult members of the public; and lay a draft before Parliament before re-issuing the Code. The Code will set out how the sanctions made under the 2008 Regulations may be imposed. We will publish guidance later that sets out the steps that must be followed before a sanction is imposed.

Summary of responses

The consultation process consisted of a public online survey, which was accessible via Gov.UK and ran from 17 July until 8 October 2023. Overall, we received six substantive responses and 17 partial responses.

In addition, we held two in-person engagement events on 15 September 2023 and a virtual event on 18 September 2023. A list of the delegates is on Annex A.

We followed up with a further virtual event on 8 November 2023 to discuss changes we had made to the draft Code of Practice with an offer for delegates to offer further comments.

Themes discussed at the engagement events

The most common themes raised were:

• How the new sanction would be imposed and the impact on vulnerable people

• People who lack digital skills or did not have access to suitable technology

• The circumstances where the other sanctions would be imposed.

Discussion at the engagement events

We asked attendees several questions about the draft Code of Practice to encourage discussion:

How do you see the new Code of Practice affecting you?​

A large employer wanted assurance that it would not be responsible for ensuring its employees maintain their UKVI account and eVisas or face financial penalties if the individual fails to maintain their records. If an individual who has a UKVI account and an eVisa fails to update their facial image at least once every 10-years they will not be able to create a Share-Code until they have updated their facial image.

Do you consider the approach set out by the Code for applicants who do not follow application requirements to be reasonable?​

There was concern about how the Code might impact vulnerable people, particularly those with limited digital skills or lack access to suitable technology. Several stakeholders wanted assurance that status holders would be able to update their details quickly and to be able to minimise the risk of not being able to create a Share-Code or avoid any other sanction being imposed.

Does the section on vulnerable people provide sufficient protection?​

Stakeholders recognised the Code did identify some types of individuals as vulnerable, but raised concern that it did not include individuals who have limited digital skills or lack access to suitable technology. They also wanted to know how we would deal with such people and where they could obtain support.

Stakeholders wanted assurance about how we handle accounts and eVisas that are compromised, so that vulnerable status holders do not find themselves subject to sanctions when they are victims rather than perpetrators.

Is 70 years old the right age for exempting people from having to update their data, including their facial image?​

There was consensus that age 70 was about the right age to exempt people from being mandated to keep their personal data, including their facial image up to date. However, concern was raised about people who last update their facial image when they reach 61 years of age and the risk of having to check a very old facial image when the individual reaches their 70s.

Is the requirement for under 16s to update their facial image every 5 years reasonable?​

Delegates considered this reasonable from a child safeguarding perspective. This is similar for other documents such as UK passports and the current physical BRP cards.

Does this fairly balance the onus of responsibility on status holders and 3rd party checkers?​

While many delegates were satisfied with the balance, a significant proportion thought that more information was needed to understand how sanctions would actually be applied as they considered the draft Code was not sufficiently clear on how they would work in practice.

How will you inform people with settled status?

Over the oncoming months, we set out how we plan to communicate the changes to foreign nationals who are settled in the UK and explain the steps they need to take to obtain a UKVI account and an eVisa.

Will the Code apply to holders of legacy documents?

The Code will only apply to holders of biometric immigration documents, including BRPs. However, we would strongly encourage all settled foreign nationals who hold legacy immigration documents to obtain a UKVI account and an eVisa, to ensure they can continue proving their rights when living in or travelling to the UK easily.

How will the Code impact individuals with limited digital skills or lack access to suitable technology?

We have updated the draft Code to ensure people with limited digital skills or lack access to suitable technology are treated as vulnerable. The Code will make it clear that no sanction should be applied where an individual has taken reasonable steps to comply with the regulations. In addition, vulnerable people will be able to use helpers and proxies to assist them to set up and manage their UKVI account.

Follow-up events

Following the engagement events in September, we followed up with a further event in November, which took place over MS Teams after we updated the draft Code and provided the delegates with a sample of the accompanying draft guidance. A list of the delegates for the November event can be found at Annex A.

In addition, we received separate correspondence from the Immigration Law Practitioners Association (ILPA) and took account of their comments and made changes to the draft Code.

Do the changes to the draft Code reflect the comments you made in response to the consultation and previous engagement sessions?​

There was recognition that we had made some changes to the draft Code that addressed some of the points previously raised. However, there remained issues some of the attendees wanted us to address particularly in terms of how sanctions would be applied. We stated there will be separate guidance that will set out the process in greater detail, including aspects of the UKVI account and eVisas which are not governed by the Code, for example updating email or postal addresses.

Will any individual receive a share code sanction before they receive a written notification?

There will always be at least one warning before a share code sanction is applied. We expect to issue multiple notifications before a final warning is issued. We prefer not to apply sanctions but encourage compliance.

How long might an individual be subject to a share code sanction when the individual’s uploaded facial image cannot be automatically matched?

In most cases updating a new facial image should be quick, however there will be some circumstances where the request to upload a new facial image needs further investigation. For example, the individual who is attempting to enrol a new facial image is a possible imposter. While we plan to mandate status holders to update their facial images at least every 10-years, we recommend status holders to do it more frequently. It is important for individuals to ensure they are always in control of their accounts and to update them whenever their personal information changes. We will intervene to ensure it is the rightful account holder and, in some cases, we may need to check their fingerprints where we have doubts about their claimed identity.

Why has paragraph 81 of the Code increased discretion for cancelling/curtailing leave (to ‘may consider’ from ‘will only consider’)?

The draft Code has been updated to change the wording back to “will only consider”. We have updated paragraph 81, so it should be clearer who it affects. We have also included people who are allowed to defer enrolling their biometrics overseas but fail to enrol them following their arrival in the UK.

Will there be a mechanism to deal with exceptional cases where a new facial image has not been uploaded?

We said we will go away with this question and develop it further and come back with an answer. There is an existing mechanism in place for people who have made an application for new permission or to apply for a replacement document. We will set out in guidance what an individual or third-party needs to do in such circumstances. This includes where an individual has attempted to upload a new image but could not be matched before the facial image is due to be updated.

What are the timescales to notify individuals about needing to update their facial image?

We would look to start around 6 months before an individual needs to update their facial image but ramp up as the individual moves towards the deadline. We will ensure we communicate the importance of keeping details up to date, so that they are aware of the consequences and the risks of not doing so.

Paragraph 46 is not clear about who the actual individual is to be sanctioned.

We have updated paragraph 46 to make it clearer.

What constitutes reasonable steps for individuals with limited digital skills or access to technology?

Once an individual has contacted the Resolution Centre it should trigger us to intervene and assist the individual, however the individual will have to show they have taken reasonable steps to follow the guidance. Before any sanction is applied decision makers will be required to consider the particular individual’s circumstances. For example, what might be reasonable steps for somebody who is able to use digital technology but happens not to have a smartphone but could access technology at a local library or borrow from a friend, might be different to what’s reasonable steps for an elderly individual who’s not confident using any kind of digital technology and would need somebody else to support them.

Is there going to be a process whereby the Home Office reminds individuals to update their facial image after 10 years since their last update?

Yes, we would not stop sending notifications. We will look at the process by which we go from notifications to warning letters and then beyond.

Responses to survey questions July – October 2023

We conducted an online consultation on Gov.UK between July to October 2023 - https://www.gov.uk/government/consultations/biometric-registration-regulations-changes-to-the-code-of-practice, which gave the public an opportunity to consider the draft Code of Practice and provide their feedback.

Survey approach

Views on the proposed code of practice were collected via an online survey. The survey included a mixture of quantitative ‘agree/disagree’ questions and free text qualitative questions. The survey was divided into questions on:

• Application requirements;

• Requirements for facial image updates;

• Maintenance requirements;

• Sanctions and civil penalties (including age limits);

• Vulnerable groups and groups who may have difficulty complying.

Respondents were asked whether they felt proposals:

• Were sufficiently clear;

• Were proportionate;

• Were complete (i.e. did not require any additional sanctions, or requirements);

• Required any further considerations – for example unintended consequences.

Home Office Analysis and Insight collected views on the draft Code of Practice through a 12-week online survey exercise, which was conducted between 17 July 2023 to 08 October 2023. A total of 23 responses were collected, of which six responded to all questions asked. The remaining 17 respondents provided answers to some but not all questions. Respondents comprised of a mixture of individuals and individuals representing groups. Types of individual respondents included individuals such as landlords and employers while types of group respondents included charitable/non-profit, private sector, and public sector organisations.

Caveats and handling notes

The response rate to the online survey was low – only 23 individuals/individuals representing groups responded and of the 23 only six gave complete responses. This means for each question most responses were null, ‘don’t know’, or ‘prefer not to say’. A small sample size coupled with poor response rates by respondents means it is hard to draw conclusions from findings as differences between numbers of those agreeing and those disagreeing is often small. For this reason, during analysis it was considered whether a particular response has been given by groups, or by individuals, for additional context. However, findings were not formally weighted to reflect group size or characteristics. The following provides a summary of findings from this analysis. Due to the small number of responses and some respondents requesting confidentiality the summary is high-level and excludes quantified responses to questions, and direct quotes. Instead, findings focus on the sentiment of responses and some concerns raised.

Responses to survey

Respondents generally felt that application and maintenance requirements are largely clear, proportionate and do not require additions. They sought additional clarity around whether proposed changes impacted the biometric collection process itself. Additionally, the point that not all migrants may have access to digital devices was raised as a potential issue with a wholly digital process.

Regarding sanctions and civil penalties overall, respondents felt the nature and circumstances under which sanctions might be used are clear and proportionate, with some concerns raised around vulnerabilities. Most respondents agreed that the proposed civil penalties are proportionate. Opinions were divided on the proposed age limit for sanctions with some respondents feeling that the age limit of 70 years old is too high.

Finally, while the majority of respondents felt the proposals in general are sufficient to ensure fair treatment of vulnerable people, there were some specific groups highlighted who might have difficulty complying with the proposed legislation. It was suggested that a named location to visit and ask questions would support any vulnerable groups who do struggle.

Summary of views

The overall view was the draft Code which supports the planned requirement for status holders to update their facial images at least once every 10-years until they reach 70 years old was generally proportionate. A small number of people suggested it should be set lower. At the engagement events we explained our reasons for setting the age a few years above the retirement age, which is to reflect that some people work beyond the age they are eligible to receive a state pension.

Most stakeholders wanted assurance that status holders would be given plenty of warnings about the need to update their facial image before any sanctions are imposed and assurance there are safeguards in place for vulnerable people. There was concern that the original draft Code of Practice did not identify people with limited digital skills or lacked access to suitable technology as vulnerable, which we have now addressed.

Stakeholders wanted to better understand how the sanctions would be applied, particularly civil penalties and immigration sanctions that could result in the revocation of an individual’s immigration status. Separate guidance will be produced to set out to decision makers how they should apply the Code when they decide to impose a sanction.

Changes to draft Code of Practice

Following the consultation process we have amended the draft Code to reflect some of the points raised. The changes are as follows:

• Paragraph 12 – Made it clear the application requirements also apply to applications to replace documents.

• Paragraph 13 – Updated and reordered the maintenance requirements.

• Paragraph 19 – Makes it clear that any notification issued to an individual applying from overseas will be in digital format only.

• Paragraph 19 - Includes a minimum period in the Code that sets out by when an individual must respond to a requirement of the regulations before a sanction may be applied. This will be no less than 14 days, but it can be longer.

• After paragraph 24 – Reference to stateless persons removed from the draft Code.

• Paragraph 26 – Makes it clear that individuals reaching their 10th or 70th birthday must update their facial image. After they have updated their image after their 70th birthday they will no longer need to update their facial image but remain free to do so, if they choose.

• Paragraphs 31–32 – New paragraphs about updating other relevant biographical information, such as a change of name.

• Paragraph 46 – Rephrased so it is clearer on who the requirements apply to.

• Paragraph 81 – Wording changed back from “may” to “will only”, but also a new line is added to reflect the policy in the “Unable to travel to a Visa Application Centre to enrol biometrics (overseas applications)” guidance where we have exceptionally agreed to defer the requirement to enrol biometrics until the individual arrives in the UK.

• Paragraph 86 – Additional bullet to ensure individuals who have limited digital skills or lack access to suitable technology are regarded as vulnerable.

• Paragraphs 94-96 – New section about people with limited digital skills or lack access to suitable technology.

• Paragraph 99 – Additional bullet to cover people with limited digital skills or who lack access to suitable technology who have taken reasonable steps to comply with the regulations, so that a threat of a sanction is removed.

Conclusion and next steps

The responses to the survey and the engagement sessions have enabled us to identify issues in the draft Code and the policy proposals that needed to be further worked through. While many stakeholders considered the proposals for periodically updating facial images is fair, there was concern the Code did not recognise people with limited digital skills or who lack access to suitable technology as vulnerable. The draft Code was updated to reflect these concerns.

We agreed with stakeholders that we would publish draft guidance on how the Code would be implemented. We also agreed to continue to engage with our stakeholders on the development of the guidance before the draft is published.

Consultation principles

The principles that Government departments and other public bodies should adopt for engaging stakeholders when developing policy and legislation are set out in the Cabinet Office Consultation Principles 2018.

Annex A – List of respondents

Attendees at the engagement events – September 2023

Organisation

Major Retailer

Management Consultants

Immigrant Rights Groups

Trade Union

Migrant Lobbying Organisations

Financial Organisations

International Student Groups

Employment Agencies

Universities

Estate Agents

Care Home Associations

Legal Representatives and Organisations

Attendees at the virtual engagement event – November 2023

Organisation

Facilities Management

Immigrant Rights Groups

Immigration and Travel Organisations

Education Organisations

Universities

Trade Associations

Boarding Schools Associations

Legal Representatives and Organisations

Migrant Lobbying Organisations