Anonymised Summary of the Judgment
Factual and Procedural Background
The court considered two related appeals heard together in a fully CLOSED hearing because of exceptional sensitivity. The appeals concern decisions made in response to a large-scale unauthorised disclosure of a dataset held by Company A ("the data incident") which contained personal details of many applicants to Program A (a relocation/resettlement scheme). The dataset included information on thousands of people, mostly located in Country A, and disclosure to hostile actors could place those named, and their families, at risk of death or serious ill-treatment.
Appellant A is an Afghan national who, between 2011 and 2019, worked as an armoured vehicle driver and security officer for various contractors assisting the Afghan Ministry of the Interior under State-funded programs (referred to in the judgment). Appellant A applied for resettlement under Program A in August 2021 on behalf of himself and his family; the application was acknowledged but not substantively progressed, and an OPEN claim for judicial review was issued in May 2023 (listed for hearing in 2025).
Appellant A's data (and that of others) was compromised in the Company A dataset disclosure. Special Advocates brought CLOSED grounds of judicial review focused on the data incident. The Second Respondent (an executive decision-maker within the State apparatus) communicated CLOSED decisions declining to offer relocation or other assistance to these appellants on the basis that they did not fall into the Secretary's categorisation of the "highest-risk cohort."
Appellant B (a different Afghan national) had assisted the British and Coalition mission in Afghanistan in various public-facing and human-rights related roles and had applied to Program A in October 2021; that claim for assistance was refused and is the subject of OPEN judicial review proceedings (heard and dismissed by the Administrative Court in 2025). Appellant B also relied on the data incident elevating his risk.
Procedurally, the Divisional Court and the Court of Appeal previously considered connected litigation about the data incident and injunctions preventing disclosure about it. The Divisional Court gave a CLOSED judgment in a related case (referred to in the judgment as the "CX1" decision) that quashed certain aspects of the Secretary's policy and required reconsideration. After reconsideration, the State revised its approach to define the "highest-risk cohort" as high-profile individuals in certain identified roles or those in other roles putting them at equivalent risk. Individual refusals in these cases were made under that revised policy. Lower courts (including Judge [Jay] and Judge [Saini]) dismissed the judicial review claims in the individual cases; these dismissals are the subject of the present appeals.
Legal Issues Presented
- Whether the Respondents' policy for identifying persons within the "highest-risk cohort" for relocation (in response to the data incident) is irrational and therefore unlawful.
- Whether the Respondents unlawfully fettered their discretion in devising or applying that policy (i.e. whether the doctrine against fettering applies).
- Whether the Human Rights Act 1998 and Article 8 of the ECHR create a statutory obligation (or jurisdictional basis) that alters the legal character of the decisions such that the doctrine of fettering or other statutory constraints apply.
Arguments of the Parties
Appellants' Arguments
- The appellants argued that the Respondents' policy was irrational because it relied on a narrow list of specified high-profile roles and did not permit effective individualised assessment of risk for persons who had performed other roles that could put them at equivalent risk.
- They argued that the policy effectively treated being a "high-profile person" as a condition precedent and so excluded many legitimately vulnerable people without proper individual consideration.
- It was further argued that the policy was not made under the prerogative alone but involved statutory discretion (e.g. under the Immigration Act 1971 and/or a duty under section 6 of the Human Rights Act 1998), meaning the doctrine against fettering should apply and the State's approach should be subject to statutory constraints and obligations.
- One line of argument invoked jurisdictional principles under the ECHR (relying on authorities about extra-territorial jurisdiction) to contend that the State owed Convention duties in respect of information held in the UK about persons outside the UK; if so, the HRA would be engaged.
Respondents' Arguments
- The Respondents (through their counsel) maintained the policy was not irrational: it was formulated in an exceptionally difficult context (risk to life of a very large number of people), following expert assessment by Company A, and taking into account resource, operational and immigration-policy constraints; it was reasonable to prioritise those most likely to be at greatest risk.
- They submitted the policy was made and applied under prerogative powers (not as an exercise of statutory discretion), particularly because initial eligibility decisions under Program A (stage 1 assessments) are for Company A and are secret and could not be set out in published Immigration Rules without compromising protection measures.
- The Respondents contended that even if Convention rights jurisdictional questions were engaged, the Human Rights Act does not itself confer a substantive power to act; it imposes a duty not to act incompatibly with Convention rights. The power exercised to make the policy was not conferred by the HRA and therefore the doctrine of fettering (which applies to statutory discretions) did not apply.
Table of Precedents Cited
| Precedent (anonymised) |
Rule or Principle Cited For |
Application by the Court |
| Case A v The State & Anr (Divisional Court judgment in the related "CX1" litigation) [2024] EWHC 891 (anonymised) |
The judgment identified seven contextual features relevant to the data incident (risk to life, scale, arguable breach by the State, secrecy, resource allocation, absence of statutory framework) and held that a categorical exclusion of persons outside specified roles was irrational in application to particular claimants. |
The court explained the background and accepted many of the contextual features identified by that Divisional Court. It distinguished which parts of that judgment were binding and which were not, agreeing broadly with its analysis but concluding that the policy (as revised) was not irrational when viewed in context. |
| Company A v Company C and others (Court of Appeal judgment describing the data incident) [2024] EWCA Civ 838 (anonymised) |
Described the nature of the unauthorised disclosure, the secrecy measures (including injunctions and a super-injunction), and identified the potential consequences if hostile actors learned of the incident. |
The court used the Court of Appeal's summary to set out the factual and procedural background and to explain why exceptional secrecy and protective measures were in place; it relied on that factual account in evaluating the reasonableness of the policy response. |
| British Oxygen Co Ltd v Minister of Technology [1971] AC 610 (anonymised) |
Established that a public authority may have a policy but must not "shut its ears" to individual exceptions; policy must not be inflexible. |
The decision was cited as the foundational articulation of the doctrine against unlawful fettering of discretion; the court used it to explain the legal test but concluded the doctrine only applies where a statutory discretion exists. |
| R v Home Secretary, ex p. Venables [1998] AC 407 (anonymised) |
Affirmed that policies must allow for exceptions and consideration of circumstances relevant to particular cases. |
The court cited this authority in explaining the content of the anti-fettering principle and in considering whether the policy allowed for exceptions; the court concluded that the anti-fettering doctrine did not apply because the policy was made under the prerogative. |
| R (Sandiford) v Secretary of State for Foreign and Commonwealth Affairs [2014] UKSC 44 (anonymised) |
Explained that the doctrine of fettering only applies where a statutory discretion is being exercised and does not apply where the source of power is the prerogative. |
The court relied on this authority to conclude that, because the relevant decisions in stage 1 were made under prerogative powers, the doctrine against fettering did not apply. |
| R (Munir) v Home Secretary [2012] UKSC 32 and R (Alvi) v Home Secretary [2012] UKSC 33 (anonymised) |
Addresses the interaction between statutory immigration powers and residual prerogative powers; Alvi contains the proposition (in some passages) that immigration controls are the "creature of statute." |
The court discussed these decisions as part of the debate on whether the 1971 Act displaced the prerogative in this context. It considered their reasoning but distinguished the present, highly exceptional circumstances as supporting the view that the policy here was adopted under the prerogative. |
| Ali v Home Secretary [2016] UKSC 60 (anonymised) |
Discusses residual powers and the relationship between statutory rules and prerogative practice in immigration contexts. |
The court referenced it in assessing whether the policy could be regarded as a statutory exercise; it held that the facts here differed and that the present policy was properly characterised as prerogative-based. |
| R (Turani) v Home Secretary [2021] EWCA Civ 348 and R (Marouf) v Home Secretary [2023] UKSC 23 (anonymised) |
Contain dicta and analysis recognising that formation of a relocation/resettlement policy may be an exercise of prerogative power distinct from later statutory stage decisions. |
The court relied on those authorities to support the view that making a background policy for relocation in response to the data incident was an exercise of prerogative power rather than a statutory decision-making exercise. |
| S & Anr v Home Secretary & Anr [2022] EWCA Civ 1092 (anonymised) |
Described the two-stage process for Program A (Company A initial eligibility assessment followed by Agency A/Home Office stage for entry clearance) and the division of responsibilities between agencies. |
The court used this analysis to explain why Company A's closed-stage eligibility assessment was properly treated as falling outside the statutory decision-making that would attract the fettering doctrine. |
| Wieder v United Kingdom (2024) 78 EHRR 8 and Shehabi & Anr v Kingdom of Bahrain [2024] EWCA Civ 1158 (anonymised) |
These authorities discuss extra-territorial jurisdiction for Convention purposes and identify that acts producing effects outside the State's territory can, in some circumstances, engage jurisdiction under Article 1 of the ECHR. |
The court considered these authorities as part of the appellants' submission that Article 8/HRA obligations might apply extraterritorially. The court concluded they did not assist materially in the present context and proceeded on the basis that, even if jurisdiction under Article 1 could be established, the HRA does not itself confer the substantive power relied upon by the appellants. |
Court's Reasoning and Analysis
The court emphasised the exceptional factual matrix: a large-scale data breach affecting tens of thousands of people; the risk to life and serious ill-treatment if information reached hostile actors; the State's successful litigation to protect secrecy (including injunctions and a super-injunction) and the continuing assessment of "break glass" risk. Those contextual features were treated as highly material to the legal assessment.
On irrationality (Ground 1), the court set out the applicable standard (including the heightened scrutiny appropriate where life is at risk) but made clear the court's role is not to substitute its preferred policy line for that of the decision-maker. The central question was whether the Respondents' decision to draw the line by reference to high-profile roles (and to allow other roles only where they pose equivalent risk) was one to which no reasonable decisionmaker could properly have come.
The court accepted that the Divisional Court in the related CX1 litigation had identified serious contextual features and had quashed parts of the earlier policy as irrational in its application to particular claimants. The present court, however, concluded that after reconsideration and amendment to the policy (so as to permit consideration of other roles which may be at equivalent risk), the Respondents were rationally entitled to prioritise relocation on the basis of high-profile roles. The court underlined the practical and operational difficulties of attempting to give detailed, individualised consideration to every person potentially affected, the financial and social-resource constraints, and the risk that a widespread relocation process might itself reveal the data incident — all factors that supported the rationality of the policy as drawn.
Regarding fettering (Ground 2), the court reviewed the doctrine requiring that a public authority must not adopt an inflexible policy shutting out the possibility of exceptions. However, the court emphasised that the anti-fettering doctrine applies only where a public authority is exercising a statutory discretion. The court analysed whether the decisions in question were exercisable under statute (notably the 1971 Act and the Immigration Rules) or instead under the Royal Prerogative.
The court examined authorities on both sides of that issue. It distinguished the present circumstances from prior decisions which treated many immigration functions as statutory, concluding that the formation and adoption of the secret background policy responding to the data incident — including the initial eligibility assessment (stage 1) made by Company A — was properly characterised as an exercise of prerogative power. The court noted (and followed) authorities recognising that adoption of policy and the later statutory mechanism implementing entry clearance can be analytically distinct stages.
Because the relevant decisions at stage 1 were made under the prerogative, the court reasoned that the doctrine against fettering of statutory discretion did not apply. The court also addressed the appellants' Human Rights Act argument: even if Article 8 jurisdiction were arguable, section 6 of the HRA does not itself confer legal powers to act; it imposes duties not to act incompatibly with Convention rights. The court concluded that the HRA did not convert the prerogative policy-making into the exercise of a statutory discretion that would attract the fettering doctrine.
On other contested points, the court found that the Divisional Court's CX1 judgment was not binding in all respects on the present court; it accepted many of the contextual findings in CX1 but concluded, on the facts and the revised policy, that the Respondents' approach remained within the range of lawful responses.
Holding and Implications
HOLDING: The appeals were DISMISSED. The court rejected both grounds of appeal as applied to the cases before it: the policy was not irrational in the context in which it was adopted, and the doctrine against fettering of statutory discretion did not apply because the relevant decisions were made under the prerogative.
Implications:
- Direct effect: The individual decisions refusing relocation or assistance to the appellants (as made under the revised policy) stand; the appellants obtain no relief from this court.
- The court expressly recognised the exceptional factual context, the need for secrecy and the serious resource, operational and policy constraints which informed the State's approach. Those contextual points are central to the court's acceptance of the policy's rationality.
- The court did not purport to lay down a novel principle of public law beyond applying established authorities on irrationality and fettering. It held that, in these exceptional circumstances, the policy was properly characterised as prerogative policy-making and so fell outside the conventional fettering doctrine applied to statutory discretions.
- No broad new precedent was announced altering the general law of fettering or irrationality; the decision is closely tied to the highly exceptional facts of the data incident and the secrecy and operational constraints surrounding it.
Outcome
The appeals were dismissed by the court panel (the judgment was delivered with the concurrence of all members of the panel).
Note: This summary has been prepared solely from the text of the provided judgment and is fully anonymised in accordance with the instructions. No additional facts beyond those contained in the provided opinion have been introduced.