Millions of EU citizens could find it difficult to assert their right to remain in the UK after Brexit under Home Office rules denying them access to their personal records, the high court has been told.

The practical impact of the regulations will be to prevent those pursuing immigration claims from obtaining key material about their cases, said Ben Jaffey QC on behalf of two civil rights organisations.

The case has been brought by the London law firm Leigh Day on behalf of the Open Rights Group, which campaigns on digital issues, and the3million, a group representing EU citizens living in Britain.

They are challenging a section of the Data Protection Act 2018 that contains a new exemption permitting Home Office “data controllers” to restrict access to personal data if it would be likely to prejudice “effective immigration control”.

Mr Justice Ouseley granted permission for a full hearing of the judicial review application. It will be heard at a later date.

The bar on applicants seeing their personal records is contrary to the requirements of the EU’s charter of fundamental rights, Jaffey said. “The derogation also doesn’t comply with EU law,” he added.

“The Home Office is making greater use of large datasets in support of what was previously termed its ‘hostile environment’ policy.”

The Windrush immigration scandal had shown data was often inaccurate, the court heard. Sometimes, however, it was the only place where there was any official record of an individual’s residence.

“It may well be that a further 3 million EU residents will become subject to these protocols,” Jaffey said.

No evidence has been presented by the Home Office explaining why it has been necessary to introduce the restrictions on access to immigration files, the court was told.

Holly Stout, counsel for the Home Office, said the exemption was permissible under EU law.

Following the Windrush scandal, human rights groups, leading Labour MPs, the Joint Council for the Welfare of Immigrants, the Law Society and the Bar Council all opposed its introduction.

Rosa Curling, a solicitor at Leigh Day, said: “The attempt to remove so many people’s data rights is particularly worrying in the context of the Home Office’s hostile environment policy. Our clients are pleased to be have been granted permission so they can present their arguments in full to the court at a substantive hearing.”

Nicolas Hatton, the founder of the3million, said: “If more than 3 million EU citizens are going to apply for settled status, they must be able to do so knowing it’s safe for them to do it, with the right to see what the Home Office is doing with their data.

“Not only does this exemption go against the very purpose of the Data Protection Act (which means to protect us from data abuse from those holding our data), but it also reinforces suspicion that the Home Office has something to hide.”

Matthew Rice, the Scotland director of Open Rights Group, said: “We are delighted to have been granted permission to challenge the immigration exemption in the Data Protection Act 2018.

“The exemption undermines the fundamental right to data protection of millions across the United Kingdom and we will be seeking removal of the exemption from the act in its entirety.”