Electronic travel authorisation: privacy information notice
Published 25 October 2023
© Crown copyright 2023
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/electronic-travel-authorisation-eta-privacy-information-notice/electronic-travel-authorisation-privacy-information-notice
Introduction
The Home Office hold and process personal information supplied or collected from applications for an Electronic Travel Authorisation (ETA). An ETA provides you with permission to travel to the UK.
How we gather and use your personal information
We are only allowed to use, gather and share personal information where we have an appropriate legal basis to do so under the UK General Data Protection Regulation (UK GDPR) or the Data Protection Act 2018. The Home Office collects and processes personal information to fulfil its legal and official functions.
The Home Office will rely upon our common law powers to process and share data for purposes incidental to the maintenance of effective immigration control, in particular the processing of ETA applications made under section 11C of the Immigration Act 1971 and Appendix Electronic Travel Authorisations to the Immigration Rules. The legal basis for the processing of your personal data is Article 6(1)(e) of the UK GDPR, that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
For any special category personal data, the legal basis is Article 9(2)(g) of the UK GDPR, that the processing is necessary for reasons of substantial public interest, on the basis of domestic law which are proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Automated decision-making and withdrawals
The decision to issue an ETA will be automated, but complex or adverse decisions will always be taken by a trained officer or caseworker.
The UK GDPR provides the right not to be subject to a decision made solely on the basis of automated processing, which produces legal or other significant effects, unless the decision is required or authorised by domestic law which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests. If you do not wish to have your application considered by an automated process, you can apply for a Visit Visa.
The Home Office will start processing ETA applications instantly. It may therefore not be possible to withdraw an application once it has been submitted.
How long we keep your personal information for
Facial biometrics will be typically retained for 3 years, unless there are grounds to retain the facial image for longer. More information on the retention and use of facial biometrics can be found in the Home Office policies on biometric information.
Biographics and personal data will be retained for 15 years after the last case action in line with visa retention periods.
The mobile app, after successful submission, will not retain any data.
We continue to keep retention periods under review to ensure they meet our role of securing the UK border and ensuring we can support those who are seeking to enter or remain in the UK.
Read the Borders, immigration and citizenship: privacy information notice for more information on how we process your personal data.