Prerogative Policy-Making for Post–Data Breach Relocation Upheld: No Fettering, Rational Limitation to High‑Profile Roles

Introduction

In AFA & Ors, R (on the application of) v Secretary of State for the Home Department & Anor; QP1 & Anr v Secretary of State (OPEN Judgment) [2025] EWCA Civ 825 (24 October 2025), the England and Wales Court of Appeal (Civil Division) dismissed two linked appeals arising from the Ministry of Defence’s (MOD) highly sensitive data incident affecting thousands of Afghan ARAP applicants. The appeals were heard entirely in CLOSED session due to exceptional national security sensitivities; even the appellants and their OPEN representatives were unaware the appeals had taken place.

The cases concern whether the Government’s secret eligibility policy for offering relocation in response to the data breach is lawful. Two core issues dominated:

Rationality: Is it irrational to confine relocation offers to those in “high-profile roles” (including roles equivalent in risk to those on the MOD’s list), rather than conducting individualized risk assessments for all affected by the breach?
Fettering: Did the Government unlawfully fetter its discretion by applying a rigid policy; and, critically, does the fettering doctrine apply where the power exercised is the Royal Prerogative rather than a statutory discretion?

The Court of Appeal held that the post–CX1 revised policy is rational and lawful. Importantly, it also held that the policy was made under the Royal Prerogative (not under the Immigration Act 1971 or section 6 of the Human Rights Act 1998), with the result that the doctrine against fettering discretion does not apply. This judgment consolidates and clarifies the legal architecture for responding to mass-risk events where secrecy and national security impede publication of criteria.

Summary of the Judgment

The Court dismissed both appeals. On Ground 1 (irrationality), it concluded that restricting eligibility for relocation to a “highest risk” cohort defined by high-profile roles (including non‑listed roles at equivalent risk) is a rational way to draw the necessary line in the face of acute operational, resource, and security constraints. The Court applied anxious scrutiny but emphasised that line-drawing amid such competing public interests is for the executive unless infected by public law error.

On Ground 2 (fettering), the Court held that the eligibility policy was formulated and applied under the Royal Prerogative, not under the 1971 Act or any power conferred by section 6 HRA. As the fettering doctrine constrains only statutory discretions, it did not apply. The Court aligned this position with Supreme Court authority and with its own analysis of the ARAP framework as a two-stage process: the MOD’s prerogative policy (stage 1, eligibility) and the Home Office’s statutory entry clearance function (stage 2).

Factual and Procedural Background

AFA & Ors

AFA, an Afghan national, served between 2011 and 2019 as an armoured vehicle driver/security officer supporting the Afghan Ministry of the Interior under UK-funded SSMI/SSCVE projects. He and his family applied under ARAP on 19 August 2021 but received no substantive response. In December 2023, a CLOSED disclosure revealed an MOD data breach (dataset shared outside MOD in February 2022) affecting thousands, including AFA. The MOD later decided (31 May 2024, CLOSED) that even assuming AFA’s claims true, he was not a high-profile individual in the sense required for inclusion in the “highest risk” relocation cohort. Jay J dismissed his CLOSED judicial review on 18 July 2024.

QP1 & Anr

QP1, an Afghan national with a public-facing profile (technical translations for Afghan security forces; NGO and development roles; gender-equality projects; representation overseas), applied under ARAP on 29 October 2021. He alleged Taliban targeting, including raids on his brother’s home. His OPEN ARAP challenge failed ([2025] EWHC 1388 (Admin)). In CLOSED proceedings arising from the data incident, the MOD (29 April 2024) declined to offer assistance because he was not within the “highest risk” cohort. Saini J granted permission on two grounds but dismissed the claim on 26 July 2024 ([2024] EWHC 1905 (Admin)).

The Data Incident and Super-Injunction Context

In Ministry of Defence v Global Media and Entertainment Ltd [2024] EWCA Civ 838 (private judgment), the Court of Appeal described the MOD’s emergency move to obtain both an injunction and a super-injunction to suppress disclosure of the data incident’s existence and content. The super‑injunction remains in place; “break glass” (widespread knowledge by the Taliban) has not occurred.

The CX1 Turning Point and Policy Revision

The Divisional Court’s CLOSED judgment in R (CX1 & Ors) v Secretary of State for Defence & Anr [2024] EWHC 891 (19 April 2024) articulated seven “important contextual features” shaping lawfulness, and quashed an aspect of the 25 March 2024 policy to the extent it categorically excluded individuals outside the listed roles without considering whether other high-profile roles might carry equivalent risk. Following CX1, the Secretary of State revised the policy on 14 June 2024 to include high-profile individuals in roles equivalent in risk to listed roles. The decisions concerning AFA and QP1 are consistent with that revised approach.

Detailed Analysis

Precedents and Authorities Cited

CX1 [2024] EWHC 891: The Divisional Court recognised the extraordinary scale and complexity of the risk (80,000–100,000 people including families), accepted that full relocation was impracticable, and held that while prioritising specific high-profile roles was rational, a categorical exclusion of all other roles was unlawful insofar as it ignored individuals in other high-profile roles at equivalent risk. It required reconsideration of the “highest risk” cohort, leading to the June 2024 revision.
Ministry of Defence v Global Media and Entertainment Ltd [2024] EWCA Civ 838: Explained the super-injunction context, the continuing risk landscape, and the concept of a “break glass” event. This backdrop justified secrecy and constrained the range of lawful policy responses.
British Oxygen Co Ltd v Minister of Technology [1971] AC 610 and R v SSHD, ex p Venables [1998] AC 407: Classic fettering authorities—public bodies with statutory discretion may adopt policies but must be willing to depart from them in individual cases.
R (Sandiford) v Secretary of State for Foreign and Commonwealth Affairs [2014] UKSC 44; [2014] 1 WLR 2697: Critical authority that the fettering doctrine applies to statutory discretions; prerogative powers are not constrained in the same way.
R (Munir) v SSHD [2012] UKSC 32; R (Alvi) v SSHD [2012] UKSC 33; Ali v SSHD [2016] UKSC 60: Address the extent to which immigration control is a creature of statute; the need for “rules” affecting entry to be in Immigration Rules; and the scope of residual powers.
R (Turani) v SSHD [2021] EWCA Civ 348; R (Marouf) v SSHD [2023] UKSC 23; [2025] AC 130: Confirm that the adoption of a resettlement policy may be an exercise of the prerogative, distinct from the statutory function of granting entry clearance. The Court of Appeal in the present case draws a direct analogy.
S & Anr v SSHD & Anr [2022] EWCA Civ 1092: Describes ARAP as a two-stage process: MOD stage 1 (eligibility) and Home Office stage 2 (entry clearance under the Immigration Rules).
Wieder v United Kingdom (2024) 78 EHRR 8; Shehabi & Anr v Kingdom of Bahrain [2024] EWCA Civ 1158; [2025] 2 WLR 467: On ECHR extraterritorial jurisdiction. The Court accepts the principles but resolves Ground 2 on a more fundamental point—section 6 HRA is not a power-conferring provision.

Legal Reasoning

Ground 1: Rationality of the “High-Profile” Cohort

The appellants framed rationality in two ways: first, by arguing that the Divisional Court in CX1 did not authorise the Government’s ongoing reliance on a role‑based approach; second, by contending that limiting relocation to those in high-profile roles (or equivalent-risk roles) irrationally excludes individualized risk assessment across the entire cohort.

The Court of Appeal clarified that CX1 did not finally determine the lawfulness of the revised policy, but, applying anxious scrutiny to the present policy, it held that:

The unprecedented context—risk to tens of thousands; intense resource, operational, and social policy constraints; secrecy and “break glass” risk—permitted line-drawing without mandating case-by-case assessment for all.
After CX1, the policy was rationally refined to cover both listed high-profile roles and other roles at equivalent risk. This approach directly addresses the specific unlawfulness identified in CX1 (a rigid role list) while preserving practicability.
There is no public law requirement to relocate everyone in the dataset. The narrow question is whether the line drawn is rational; the Court held that it is.

Notably, the Court emphasised that courts do not choose where to draw the line; they assess whether the executive’s line is rational, particularly where competing public interests are acute and no fully satisfactory solution exists.

Ground 2: Fettering and the Source of Power

The fettering challenge turned on the source of the Government’s power. If a statutory discretion was being exercised, British Oxygen and Venables would require openness to exceptions. The Court held, however, that:

The eligibility policy responding to the data incident was adopted and applied under the Royal Prerogative, not under the Immigration Act 1971 or any power conferred by section 6 of the Human Rights Act 1998.
Section 6 HRA imposes a duty (not to act incompatibly with Convention rights) but does not confer a decision-making power. Thus, it cannot be the statutory hook for fettering analysis.
Consistently with Marouf, there is a critical distinction between adopting a resettlement/relocation policy (prerogative) and granting entry clearance (statute). ARAP is a two-stage architecture: MOD determines eligibility (stage 1, prerogative), and if positive, the Home Office processes and grants visas (stage 2, statutory).
This division also explains why eligibility criteria for the secret policy need not (and cannot) be set out in the Immigration Rules or laid before Parliament; those Rules govern the Home Office’s statutory stage, not the MOD’s prerogative stage.

Because the relevant decisions were prerogative-based, the doctrine against fettering discretion did not apply. The Court nevertheless reviewed the policy for rationality and found it lawful.

Impact and Significance

This decision is a significant development at the intersection of national security, immigration, and public law. Key implications include:

Prerogative policy space confirmed: The Court endorses a clear structural separation between prerogative policy-formation (stage 1 eligibility) and statutory immigration decision-making (stage 2 entry clearance). This limits the reach of doctrines like fettering in challenges to eligibility policies crafted under the prerogative.
Rationality standard under anxious scrutiny: Even with anxious scrutiny given the risk to life, courts will not require individualized assessments for every affected person where the executive has rationally prioritised a defined “highest risk” group aligned with practicability and security.
Post‑CX1 stability: The revised policy (including non-listed high-profile roles at equivalent risk) is now Court of Appeal–approved as rational. Structural challenges seeking wholesale individualized assessment are unlikely to succeed.
Limits on HRA as a power-source: Section 6 HRA does not create decision-making powers. It cannot be used to transform a prerogative policy into a statutory discretion (or to import fettering obligations).
Secrecy and accountability: The ruling accepts that compelling national security and “break glass” risks justify secret criteria at the eligibility stage, with judicial supervision focused on rationality and lawfulness rather than publication or parliamentary laying of rules.
Future litigation focus: Viable challenges will likely turn on whether an applicant is properly characterised as “high-profile” and at equivalent risk to the listed roles, or on misapplication of the policy to the particular facts, rather than on broad policy rationality. After this judgment, high-level attacks on the policy’s structure face steep headwinds.

Complex Concepts Simplified

Royal Prerogative vs Statute: The prerogative is the residual executive authority historically vested in the Crown, exercised today by ministers. Where a matter is governed by statute, the statute typically displaces the prerogative. Here, the Court held that formulating a secret eligibility policy responding to the data incident is a prerogative function, separate from the Home Office’s statutory task of issuing visas.
Fettering of Discretion: A public body with a statutory discretion may adopt a policy but must not apply it inflexibly; it must be open to exceptions. This doctrine applies to statutory powers. It does not constrain prerogative decision-making (Sandiford).
Wednesbury Rationality and Anxious Scrutiny: A decision is unlawful if so unreasonable that no reasonable authority could have made it. “Anxious scrutiny” means the court examines the reasons more closely where fundamental interests (like life and safety) are engaged. Even so, courts will not substitute their view for rational executive line-drawing in complex, resource‑laden environments.
“High-Profile Roles” and “Equivalent Risk”: After CX1, the highest-risk group includes not only those in listed roles (e.g., judges and journalists identified in CX1) but also others whose roles expose them to equivalent risk. It is not a free-standing individualized risk assessment for all; it is a targeted eligibility criterion.
Closed Proceedings, Special Advocates, and Super-Injunctions: Where disclosure risks lives or national security, courts may proceed in CLOSED, appointing Special Advocates who review sensitive material on behalf of the claimant but cannot freely share it. A super-injunction restrains publication of the existence of an injunction itself. Here, secrecy is central because a “break glass” event (Taliban learning of the leak’s details) could escalate risks dramatically.
Section 6 HRA Is Not a Power: Section 6 imposes a duty not to act incompatibly with Convention rights but does not create decision-making authority. A public authority’s power must derive from statute or the prerogative. Hence, section 6 cannot anchor a fettering challenge.
ECHR Jurisdiction: Jurisdiction under Article 1 ECHR is primarily territorial but has exceptions. The Court did not need to resolve jurisdiction because even assuming it, section 6 HRA does not supply the needed statutory discretion for fettering.

How This Decision Interacts with CX1

The Divisional Court in CX1 did two major things: it approved prioritising high‑profile roles as a rational response to mass risk, and it rejected a categorical exclusion of non‑listed roles. The Government revised the policy accordingly on 14 June 2024. The present judgment confirms that the revised approach fits within the zone of rationality, while clarifying that CX1 did not mandate individualized assessment for all affected persons. It also provides the crucial doctrinal refinement that the eligibility policy is a prerogative measure impervious to classic fettering arguments.

Practical Takeaways for Practitioners and Claimants

Challenges should focus on showing that a claimant is a “high-profile” individual whose role, though perhaps not listed, places them at equivalent risk. Evidence on public prominence, identifiable association with UK or coalition missions, and documented targeting will be key.
Arguments that the Government must carry out generalized individual risk assessments for all affected applicants are unlikely to succeed post–AFA/QP1.
Fettering arguments will fail at the eligibility stage because the policy is prerogative-based. However, once a case moves to entry clearance (stage 2), statutory obligations under the Immigration Act 1971 and the Immigration Rules resume.
Article 8 ECHR arguments premised on private/family life in the UK will face difficulties where the claimant has no UK connection; jurisdiction issues remain complex but were not determinative here.
The policy is to be kept under review; significant changes in the threat landscape (e.g., a “break glass” event) may justify further legal reassessment of the balance struck.

Conclusion

The Court of Appeal’s decision in [2025] EWCA Civ 825 marks an important consolidation of legal principles governing executive responses to mass-risk, national security–sensitive data incidents with overseas effects. It establishes that:

Formulating a secret eligibility policy for relocation in response to the MOD data incident is an exercise of the Royal Prerogative, not a statutory discretion under the Immigration Act 1971 or section 6 HRA; accordingly, the fettering doctrine does not apply to that policy formation and application.
The revised policy focusing on “high-profile” roles and equivalent-risk roles is rational and lawful in light of the exceptional constraints and competing public interests, even under anxious scrutiny.
Section 6 HRA is a duty, not a power; it cannot be used to recast prerogative policy-making into a statutory discretion amenable to fettering arguments.

In the broader legal landscape, the judgment reinforces the prerogative’s continuing role in immigration-adjacent policy-making where secrecy is essential and aligns with Supreme Court guidance distinguishing strategic resettlement policy from statutory entry clearance decisions. For future litigation, the battleground narrows: the scope for systemic challenge is limited, and case-specific disputes will likely hinge on whether the claimant truly is “high-profile” and exposed to equivalent risk to those in the listed roles.