AFA & Ors, R (on the application of) v Secretary of State for the Home Department & Anor

These are two appeals that raise similar, although not identical, issues. They were heard together before us at an entirely CLOSED hearing. Even the Appellants, and their OPEN representatives, are not aware that the appeals have taken place before this Court, because of the exceptional sensitivity of the background. For the same reason, even the initials used in referring to the Appellants in the OPEN listing of the appeals were different from the initials that I will use in this CLOSED judgment: they were referred to as AH and AC. I will refer to the principal Appellants as AFA and QP1. The other Appellants are members of their respective families.

The Appellants are Afghan nationals. Between July 2011 and March 2019 the First Appellant (AFA) worked as an armoured vehicle driver and security officer for various companies, assisting the Afghan Ministry of the Interior, which in turn was funded by the United Kingdom (“UK”) Government-funded Strategic Support to the Ministry of the Interior (SSMI) program and the Strategic Support for Countering Violent Extremism (SSCVE) project. The other five Appellants are the First Appellant’s wife and children.

Following the return of the Taliban to power in Afghanistan, on 19 August 2021 the First Appellant submitted an application for resettlement in the UK under the Afghan Relocations and Assistance policy (“ARAP”), on behalf of both himself and his family. His application was acknowledged in January 2022. Because there had been no substantive response to his application, the Appellants issued a claim for judicial review on 9 May 2023. That OPEN claim is listed for hearing in the Administrative Court in July 2025.

Separately, in December 2023, it was disclosed only in CLOSED that there had been a Ministry of Defence (“MOD”) data breach affecting many thousands of people, including one or more of these appellants. The MOD dataset, containing significant personal details of ARAP applicants was inadvertently shared outside the MOD in February 2022.

On 23 January 2024 the Special Advocates filed CLOSED grounds of judicial review, exclusively addressing the data breach issue. A CLOSED hearing was listed in the Administrative Court for 22 May 2024.

In the meantime, on 19 April 2024, the Divisional Court gave its judgment in R (CX1 & Ors) v Secretary of State for Defence & Anr [2024] EWHC 891. I will return to that judgment in detail below.

On 31 May 2024 the Second Respondent sent a CLOSED letter to the Special Advocates, declining to take any further action in relation to the Appellants. The material part of the decision letter stated the following:

“In short, it is considered that AFA has not performed any of these specific roles as identified in the MOD’s list containing examples of high profile roles, nor is he a high profile individual who has performed another role who is at equivalent risk. As such, having regards to AFA’s circumstances, he does not fall within the highest-risk category so as to require access to apply for relocation. …

We have not assessed whether or not the claimant’s claims as to his factual circumstances are true. However, even on the assumption that the claims made are true, we do not consider that, by reason of his role as an armoured vehicle driver facilitating the transport of foreign consultants working on the SSMI program, the claimant is a high profile individual in the sense already referred to such that he would fall into the highest risk category.”

The Special Advocates filed amended grounds for judicial review dated 12 June 2024, addressing the decision of 31 May 2024. The application was heard by Jay J at a rolled-up hearing on 18 July 2024. He dismissed the claim for judicial review.

QP1 is an Afghan national who assisted the British and Coalition mission in Afghanistan prior to the Taliban takeover. That assistance included translating the manuals of military vehicles donated by the US and others to the Afghan security forces; working for various non-governmental organisations, including Médecins sans Frontières; representing Afghan missions on visits to Paris and The Hague; and working as a project officer for Afghan Aid and English humanitarian development organisations. These roles included work in the field of gender equality/gender-based violence. QP1 is married to QP2. In his witness statement filed in the OPEN judicial review proceedings, QP1 states that he was regarded as a “spy” and has had to go into hiding.

On 29 October 2021 QP1 made a claim for assistance under the ARAP scheme. In materials filed in connection with that claim, he explained that he had been targeted by the Taliban. In particular, his brother’s house has been looted on two occasions. The Taliban had approached his brother, searching for QP1, declaring him to be an “infidel Hazara and a spy for the Americans.”

The claim for assistance under the ARAP scheme was refused and QP1 has challenged that decision in OPEN judicial review proceedings. The OPEN claim was heard in the Administrative Court by Farbey J on 5 March 2025 and judgment was given on 10 June 2025: [2025] EWHC 1388 (Admin). The OPEN claim for judicial review was dismissed for reasons which are not material for present purposes.

In the meantime, on 16 April 2024 Kerr J made an order in CLOSED, requiring the Second Respondent to decide on the action, if any, to be taken to address the risk to the safety of the Appellants by reason of the data incident.

On 29 April 2024, pursuant to that order, the Second Respondent communicated his decision to the Special Advocates, again in CLOSED. The decision was that no assistance would be offered to the Appellants, in particular because they were deemed ineligible for relocation, since they did not fall within the policy adopted by the Second Respondent to identify those eligible for relocation in light of the data breach. The basis for the CLOSED decision was that “neither of the claimants fall within the highest-risk category, whether because they are high-profile individuals who performed specific roles identified in the MOD’s list or because they are high-profile individuals who performed other roles who are at equivalent risk, depending on their particular circumstances.”

The application came before Saini J at a rolled-up hearing on 23 July 2024. Although Saini J granted permission to apply for judicial review on two grounds, refusing permission on the third ground then being advanced, he then dismissed the claim for judicial review.

The background was summarised in outline as follows by the Court of Appeal (Sir Geoffrey Vos MR, Singh LJ and Warby LJ) in Ministry of Defence v Global Media and Entertainment LTD and others in its private judgment [2024] EWCA Civ 838, at para 2:

“The claim arises from the fact that someone working for the UK Government made an unauthorised disclosure of secret information of a kind that would put lives in jeopardy if it fell into the wrong hands. The [Ministry of Defence or “MOD”] later learned that the existence of such a data incident had become known to journalists and others and at least some of the information itself was in unauthorised hands. Fearing further disclosure, the MOD brought proceedings for an injunction. It applied in private for orders against the world at large. The judge who was dealing with urgent applications at that time in the King’s Bench Division, Robin Knowles J, granted an interim injunction which prohibited any person from disclosing information about the incident. He also made an order for a ‘super-injunction’ prohibiting disclosure of the fact that an injunction had been sought and granted.”

The facts were set out in a little more detail at paras 9-13 of that judgment. As the Court noted at para 11, most of the people whose details were leaked in the data incident were located in Afghanistan but there were also smaller numbers in other countries. If their details were to fall into the hands of the Taliban, they and their families would be at risk of being killed or subjected to torture or other serious harm. As the number of family members involved is several times the number of affected people, the total number of people who would be exposed to that risk is between 80,000 and 100,000.

The MOD became aware of the data incident in August 2023 and applied for an urgent injunction, which was granted by Robin Knowles J on 1 September 2023. After subsequent hearings before Chamberlain J, eventually on 21 May 2024, he decided that the injunctions should be discharged. An appeal by the MOD to the Court of Appeal was successful. The Court gave both a private judgment and a CLOSED judgment on 26 July 2024. In the course of those proceedings reference was made to what has become known as a “break glass” event, that is when the data incident becomes known to the Taliban.

The consequence is that, although the injunction and the super-injunction are, pursuant to the order of the Court of Appeal, kept under review by the High Court, the position remains that both injunctions are still in place and “break glass” has not yet occurred.

As I have mentioned, the Divisional Court (Dingemans LJ, Johnson J and Chamberlain J) gave its CLOSED judgment in the case of CX1 on 19 April 2024. As the Court observed at para 10, the underlying circumstances have given rise to exceptional challenges for the Respondents. It is not possible fully to mitigate the risks to so many lives that have been created by the data leak. The Respondents have to take account of many different, sometimes competing, considerations when determining the appropriate policy to respond to the data leak and to mitigate the risks that have been created. It was clear from the evidence that substantial consideration had been given to the issues that arise at the most senior official and Ministerial level.

The Court noted at para 11 that, just a day before the hearing, an important decision was made by the Secretary of State for Defence on 25 March 2024. In the unusual circumstances of the case, all parties were content that this should be reviewed by the court although the court does not usually entertain “rolling judicial review claims”. At para 36, the Court observed that, since almost 100,000 people are affected by the data leak, it would take years to relocate the entire cohort, at a cost of £2.5-3 billion. Furthermore, there are not only the practical difficulties in individuals relocating from Afghanistan but there is also an acute housing shortage in the UK, and there are existing pressures on local government. Also, providing a route to the United Kingdom for significant numbers of those names in the dataset may itself give rise to a risk that the fact of the data leak will become known. It is therefore necessary to prioritise those at the highest risk.

At para 40, the Court outlined the three grounds of challenge to the policy of 25 March 2024 in the proceedings before it:

At para 41, the Court summarised the “central theme” of the rationality complaint as being that “the targeted cohort who will be offered relocation has been identified by reference to narrowly drawn criteria which preclude an individualised assessment of risk. In particular, no individual assessment has been made of whether MP1 and CX6 fall within the group of those who are at highest risk.” MP1 and CX6 were the relevant claimants before the Court.

At para 43, the Court set out the following seven “important contextual features”: there was (1) the existence of a risk to life and a risk of torture, (2) to almost 100,000 people, as a result of (3) a strongly arguable breach of the law on the part of the UK Government, in circumstances where (4) those affected are not aware of what has happened and are disabled from taking action to protect themselves, because (5) the Government has, highly exceptionally, secured a super-injunction on the basis of a promise to the court that it would take all practical steps to protect those at risk as soon as possible, in circumstances where (6) the decision-making is fraught with risk and involves the allocation of significant resources, potentially to the detriment of others, and (7) there is no statutory framework regulating the decision-making.

Addressing the rationality challenge at paras 55-65, the Court was content to assume that the Secretary of State for Defence was justified in concluding that it is not practicable to relocate all those at risk to the UK. It necessarily followed that very difficult decisions had to be made as to who should and should not be relocated. The Court said that the Secretary of State was “entitled to conclude the high-profile individuals in the roles that they have identified fall into the highest risk category, and that they should therefore be prioritised for protection (subject to making appropriate alternative provisions for the rest).” [MOD does not exclude the possibility that high-profile individuals occupying other roles may also fall into the same highest risk category. That is because the highest risk category is concerned with those occupying high-profile roles and MOD gives only a non-exhaustive list of examples of such roles.] The strong implication was that other high-profile people holding other roles would be at equivalent risk, depending on their particular circumstances. Yet it appeared that the decision-making had processed on the basis that only those who claimed to have held one of the specified roles could qualify for relocation.

At para 58, the Court said that there was no evidence that it would be impracticable to give individual consideration in each case to determine whether another high profile person, albeit with a different role, fell within the highest risk category. Since the Secretary of State had at least some information about each applicant, because they have all made an ARAP application, he had at least some information on which to assess whether they were high profile, and whether their role would expose them to the same risk as those in the identified roles. The Court said that it would “leave open the question as to whether it is necessary to give separate and individual consideration to every ARAP applicant because it is at least conceivable that there will be some persons who cannot on any view be considered high profile. That is not the case for either the judges or journalists the subject of these proceedings.”

The Court then proceeded to consider the individual circumstances of the two remaining live cases, MP1 (a former judge in Afghanistan) and CX6 (a journalist who had worked for the BBC World Service). The Court concluded, at para 62, that it would make an order in favour of MP1 and CX6 by quashing the Secretary of State’s decision not to relocate them and requiring him to reconsider their cases.

At para 66, the Court observed that it was not necessary in those circumstances to address other rationality challenges because they had, to a large extent, been overtaken by the decision of 25 March 2024.

Finally, at para 71, the Court quashed paragraph 2c of the decision of 25 March 2024 not to offer relocation to the UK to individuals outside (what the Secretary of State for Defence has determined to be) the highest risk cohort. The Court said that a rule which categorically excludes anyone not in the identified roles “is irrational in its application to the claimants.”

In its order in CX1 dated 23 April 2024 the Divisional Court directed, at para (5), that the Secretary of State for Defence “shall reconsider the approach to be taken to identifying those within the highest risk cohort for the purposes of the 25 March policy” by 14 June 2024. In a letter dated 14 June 2024 the Government Legal Department confirmed that the Secretary of State had undertaken that reconsideration and had decided “that the highest risk cohort for the purposes of the 25 March policy comprises high-profile individuals who either (i) held one of the roles identified in the MOD’s list; or (ii) held a different role which puts them at equivalent risk to those in the identified roles.”

It will be seen from the terms of the revised policy that the focus remained on whether an individual had been in a relevant role and did not envisage consideration of the particular circumstances of any individual no matter what their role had been.

Although the relevant decisions in these individual cases preceded that document, they followed reconsideration of the policy after the judgment in CX1 and are consistent with the policy of 14 June 2024.

The judgment in AFA & Ors was given by Jay J on 18 July 2024. So far as still remains relevant, the judge addressed the grounds advanced by Mr Lemer as follows. At para 40, the judge said that, in line with paras 55 and following in CX1, the issue for him was whether, applying the anxious scrutiny standard to the relevant material, and taking on board that the Wednesbury test includes establishment of a demonstrable flaw, the reasoning of the Secretary of State, which did not go beyond an examination of the roles played by the notional applicant, was irrational. The judge considered that the evidential basis for the Secretary of State’s arguments had been made out. He considered that the relevant passages in CX1 identified very important resource, operational and immigration policy considerations which bore on the circumstances of this case. He said that an important factor was the view of officials advising the Secretary of State that it would be extremely difficult to assess the risk posed to individuals whose cases were not being considered in connection with their claimed role. Moreover, the wider policy which was the logical upshot to Mr Lemer’s submissions would create two difficulties. First, it would undermine the justified aspiration to focus on the high-profile groups, and, secondly, its practical bounds would be difficult to identify beyond saying that virtually everybody would surely be comprehended within it.

The judge addressed the other ground of challenge which still remains relevant, and which was based on Article 8 of the European Convention on Human Rights (“ECHR”) at paras 44-49 of his judgment. The judge considered that the argument had “a complete air of unreality about it”: see para 48. He said that the Appellants could not rely on Article 8 because they do not have a private or family life in the UK, only in Afghanistan. He also considered that there was no statutory discretion which had been exercised by the Secretary of State, only a prerogative power. The judge said that the Secretary of State’s policy could not be implemented pursuant to the exercise of powers under section 6 of the Human Rights Act 1998 (“HRA”): see para 49.

The judgment in QP1 & Anr was given by Saini J on 26 July 2024: [2024] EWHC 1905 (Admin). At para 11, the judge noted that it was not suggested that any of the incidents in which QP1 was said to have been targeted (as when his brother’s house was looted by the Taliban) had been related to the data incident or had compromised his data. It was, however, said that the data incident had elevated the level of existing risk which QP1 faced as a result of his many public-facing activities, which were of a nature that the Taliban strongly opposes. The judge also noted, at para 12, that the second claimant (QP1’s wife), who is a doctor, did not have her data compromised in the data incident and her role was not said to be material to the issues before the court.

At paras 14-18 of his judgment, the judge addressed the first ground of challenge before him, that it was irrational to treat the question of whether QP1 was a high profile individual as a “condition precedent” in determining who fell into the highest risk category.

The judge said, at para 15, that the effect of CX1 is that it was lawful at the level of policy for the government, in deciding who to relocate in the light of the data incident, to consider whether a relevant applicant was a high-profile person performing one of the roles in the MOD’s list, or was a person performing another high profile role putting them at effectively equivalent risk. The judge was of the view that, like Jay J in AFA, the Divisional Court in CX1 in substance had rejected the rationality challenge, at paras 55-59 of its judgment. He said, at para 16, that the approach taken by the Government in the decision in the case before him was “a faithful application of the policy endorsed as lawful in CX1.” The judge considered that the Appellants clearly failed on the rational policy adopted by the government. At para 18, he again referred to the “endorsement by the Divisional Court of the rationality” of the policy and that this precluded the Appellants’ arguments that they were entitled to an individualised general assessment of their case as to risks elevated by the data incident.

At para 29, in the context of his consideration of whether to grant permission to appeal to this court, the judge said:

“I also consider that the Defendant correctly applied the decision in CX1. I read that decision, as did Jay J in AFA, as determining that it was lawful for the Defendants to address the very difficult situation which had arisen through a policy which prioritised those who were classed as high profile persons with particular roles or as high profile persons in other roles with equivalent risk. Had the Divisional Court decided that detailed individualised consideration of the position of every one of the 20,000 or so persons affected by the Data Incident (irrespective of their profile) was required in law, that Court could not have decided that the actual limited policy (which does not require this action) was lawful.”

There are two grounds of appeal, although only ground 1 arises in the case of QP1. Both grounds are advanced in the case of AFA & Ors. Mr Zubair Ahmad KC, who appeared for the Appellants in the case of QP1 & Anr, took the lead in making oral submissions on ground 1. Mr David Lemer, who appeared for the Appellants in the case of AFA & Ors, adopted those submissions and also made oral submissions on ground 2.

Ground 1 is that the Respondents’ policy on relocation is irrational and therefore unlawful. Strictly speaking, the ground of appeal as formulated, at least in the case of QP1 & Anr, was that Saini J erred in law because he misunderstood the true effect of the Divisional Court judgment in CX1. At the hearing before us, Mr Ahmad fairly acknowledged that it would not suffice if he were to succeed simply on that limited ground. In substance what has to be shown is that the underlying policy is indeed irrational. In any event, the judgment of the Divisional Court in CX1 is not binding on this court. As it happens, my view is that the Divisional Court did not determine the full issue which arises in these appeals. Insofar as Saini J thought that the issue had been determined by the Divisional Court, and concluded that the Divisional Court would have endorsed the lawfulness of the policy apart from the specific respects in which it declared it to be unlawful, I would agree with the Appellants that that was an error of law. However, as the Appellants fairly acknowledge, that would be an immaterial error if the fundamental position is that the underlying policy of the Respondents is not irrational and therefore not unlawful.

I accept the fundamental submission made by Sir James Eadie KC on behalf of the Respondents that the policy is indeed not irrational. I bear in mind that:-

Just one constraint on the possibilities open to the Respondents illustrates the real difficulties which arise in this context. Providing a route to the UK for significant numbers of those named in the dataset may itself give rise to a risk that the fact of the data leak will become known.

Although the judgment of the Divisional Court in CX1 is not binding on this Court I broadly agree with it. In particular, I agree with the Divisional Court about the seven “important contextual features” which I have summarised at para 23 above. Those features made the crafting of a policy that would be both just and workable very difficult. Balancing the various, sometimes competing, interests involved is quintessentially the sort of task that the law entrusts to the Secretary of State, provided there is no error of public law.

The question for this Court is not whether the line could be drawn somewhere else. It is common ground that there is no obligation on grounds of rationality for the Respondents to relocate everyone on the list, which would be approximately 20-25,000 people and, if family members are included, would be in the region of 80-100,000 people. The only question for this Court is whether the place where the line was in fact drawn by the Respondents, which is confined to high-profile roles, is a rational one.

I am very conscious that the most anxious scrutiny is called for in this context. This is not only for the usual reason that there is potential risk to life (which itself was the underlying reason for the worldwide super-injunction which has been granted) but also because in one sense it can be said that the risk has arisen as a result of the mistaken conduct of the British government. Nevertheless, the policy having been amended in the light of the Divisional Court judgment in CX1, I have reached the firm conclusion that the Respondents were rationally entitled to draw the line where they have and this cannot be said to be unlawful by the courts.

Accordingly, I would reject ground 1 in this appeal.

Ground 2 is that the Respondents unlawfully fettered their discretion in devising and applying the policy. It is well established that the doctrine against fettering entails that, while a public authority is entitled to have a policy to govern the exercise of a discretionary power, and that policy may even in practice be tantamount to a “rule”, it must not “shut its ears” and must always be “willing to listen” to an application that an exception to the policy should be made in a given case: see the decision of the House of Lords in British Oxygen Co Ltd v Minister of Technology [1971] AC 610, at 625 (Lord Reid). The policy must not be “inflexible and invariable” and must at least allow for the possibility that an exception to it may be made after “taking into account circumstances which are relevant to the particular case”: see R v Secretary of State for the Home Department, ex p. Venables [1998] AC 407, at 496-7 (Lord Browne-Wilkinson).

It is common ground that the doctrine of fettering only applies if there is a statutory discretion to be exercised. It cannot arise if the source of the power in question is the prerogative: see the decision of the Supreme Court in R (Sandiford) v Secretary of State for Foreign and Commonwealth Affairs [2014] UKSC 44; [2014] 1 WLR 2697.

Mr Lemer contends that the policy in this case was not created under the prerogative because there is no longer any room for the prerogative in immigration law and so the policy must have been created under legislation. He submits that there are two potential sources of statutory discretion in this context. The first is the Immigration Act 1971 (“the 1971 Act”). The second, and alternative, source is section 6 of the HRA.

At first blush the first submission is surprising, as section 33(5) of the 1971 Act provides that: “This Act shall not be taken to supersede or impair any power exercisable by [His] Majesty in relation to aliens by virtue of [His] Prerogative.” The reference to “aliens” is, strictly speaking, a reference to foreign nationals of countries which are not in the Commonwealth: Commonwealth citizens are not in law “aliens”, although, since the independence of their respective countries, they are no longer British subjects but are foreign nationals. It should be noted, however, that the Appellants are all Afghan nationals and so are not Commonwealth citizens.

Mr Lemer submits that the reference to “aliens” in section 33(5) of the 1971 Act is properly to be construed as being limited to “enemy aliens”, since that was made clear by the Government when the 1971 Act was being debated in Parliament: see R (Munir) v Secretary of State for the Home Department [2012] UKSC 32; [2012] 1 WLR 2192, at paras 25-26 (Lord Dyson JSC); and also R (Alvi) v Secretary of State for the Home Department [2012] UKSC 33; [2012] 1 WLR 2208, at paras 30-32 (Lord Hope JSC). In Alvi, at para 32, Lord Hope said that: “The powers of control that are vested in the Secretary of State in the case of all those who require leave to enter or to remain are now entirely the creature of statute.”

Mr Lemer accepts that the Secretary of State retains a “wide residual power” to act outside the Immigration Rules but he submits that that discretion is still one conferred by the 1971 Act and does not arise under the prerogative: see Ali v Secretary of State for the Home Department [2016] UKSC 60; [2016] 1 WLR 4799, at para 18 (Lord Reed JSC).

I do not accept that the Respondents were acting exclusively under the 1971 Act in the present context. The authorities on which Mr Lemer relies can be distinguished. They did not concern anything like the highly unusual circumstances which have arisen in the present case. In my judgment, the Respondents’ policy to respond to the data incident was indeed one that was created under the prerogative.

I note that there are dicta in other cases which suggest that the prerogative may still have a role to play in the context of immigration law: see R (Turani) v Secretary of State for the Home Department [2021] EWCA Civ 348; [2021] 1 WLR 5793, at para 62, where Simler LJ observed that the policy that was in issue in that case was “the exercise of prerogative powers to make a policy about how statutory immigration powers will be exercised.” When that case proceeded to the Supreme Court, as R (Marouf) v Secretary of State for the Home Department [2023] UKSC 23; [2025] AC 130, Lady Rose JSC approved that analysis at paras 61-62. She said that there was an important distinction between “the exercise of the function of granting entry clearance” and the adoption of the underlying policy (there the Resettlement Scheme). Although both could be regarded as stages in one process so as to bring them within the scope of section 29(9) of the Equality Act 2010 (and it is important to appreciate that that was the issue in that case, which is a very different issue from the present case), “the making of the policy underlying the Resettlement Scheme was not itself part and parcel of the exercise of a function under the Immigration Act”. Lady Rose noted that: “The policy had been adopted by the exercise of prerogative powers.”

In my opinion, there is an analogy to be drawn with the present case. Although the exercise of the powers to control leave to enter and remain in the UK can properly be said to be “entirely the creature of statute”, to use Lord Hope’s phrase in Alvi, the formation and adoption of the background policy of relocation is properly regarded as an exercise of the prerogative.

This is consistent with how the Court of Appeal analysed the (publicly avowed) ARAP policy in S & Anr v Secretary of State for the Home Department & Anr [2022] EWCA Civ 1092, at paras 15-17 (Underhill LJ). Although it is right to note that Underhill LJ said that the “terms of the policy governing relocation are given effect by paragraphs 276BA1-276BC1 of the Immigration Rules”, he went on to say that the terms of the policy were that “responsibility for decision-making about relocation under ARAP was split between the MOD and the Home Office”. He said that “the MOD is responsible for the initial assessment of eligibility for relocation”, since they are best placed to make that assessment, liaising where necessary with other government agencies in Afghanistan. It is only if an applicant satisfies that initial stage, he continued, that responsibility passes to the Home Office to ensure that appropriate checks are done and that there are no grounds for refusal under Part 9 of the Immigration Rules, and “when that is done, to issue the visa.” In other words there is a two stage process, stage 1 being for the MOD and stage 2 for the Home Office.

If that analysis is true of the publicly avowed ARAP policy, it is all the more true of the secret policy which the Respondents had to devise in response to the data incident. I accept Mr Alan Payne KC’s submission on behalf of the Respondents that a critical feature in the present context is that only the MOD could decide whether a case was eligible at stage 1. It would only be if that was answered positively that the case could go forward and in due course the Home Office would issue entry clearance. Mr Payne accepts that, once one reaches that final stage of the process, the Home Offices act under statutory powers in the 1971 Act but, before that stage is reached, and in particular at stage 1, it is the MOD which decides whether the eligibility criteria are met and the MOD is clearly not acting under the 1971 Act.

This also provides an answer to the problem that, were it otherwise, the criteria would have to be published in the Immigration Rules and laid before Parliament. Mr Lemer accepts that the criteria for entry to the United Kingdom usually have to be set out in Immigration Rules and laid before Parliament: see section 3(2) of the 1971 Act; Alvi, at para 57 (Lord Hope) and para 94 (Lord Dyson); and Ali, at paras 15-17 (Lord Reed).

It is common ground that the criteria cannot in the present context be made public and they cannot be laid before Parliament. Mr Lemer suggested that the Respondents could frame their policy to make it sufficiently discretionary that it would not constitute “rules” but, in my judgment, that is not a principled basis on which this issue can be resolved. The reality is that the criteria for eligibility under the ARAP scheme are “rules” and, if they could only be made under the 1971 Act, they would have to be published and laid before Parliament.

Turning to the HRA, Mr Lemer recognises that the first hurdle he needs to overcome is to show that the Appellants are within the “jurisdiction” of the UK within the meaning of Article 1 of the ECHR, otherwise the ECHR (and therefore the HRA) simply do not apply to these cases. The Appellants are and at all material times have been outside the territory of the UK. It is well established in the case law of the European Court of Human Rights that the jurisdiction of a Contracting State is “primarily territorial” but that there are exceptions to this. The European Court has recognised that, as an exception to the principle of territoriality, acts of a state performed, or producing effects, outside its territory can constitute an exercise of jurisdiction within the meaning of Article 1 of the ECHR: see the summary of the authorities in Wieder v United Kingdom (2024) 78 EHRR 8, at para 87. Mr Lemer places particular reliance on that judgment.

Wieder was summarised by Males LJ in Shehabi & Anr v Kingdom of Bahrain [2024] EWCA Civ 1158; [2025] 2 WLR 467, at para 41, as follows. He said that it concerned the bulk interception of communications by the UK intelligence agencies. The applicant’s communications, sent from outside the UK, had been intercepted “when they passed through” the UK. The Government argued that the interception did not fall within a state’s jurisdictional competence when the sender or recipient was outside that state’s territory. Males LJ commented that, perhaps not surprisingly, the European Court rejected that argument.

As I understand it, Mr Lemer’s submission is that, in the present context, the data incident was a breach of the Appellants’ rights in Article 8 of the ECHR because their private information was held in the UK so that it is immaterial that they themselves have at all times been outside the UK. He submits therefore that an analogy can be drawn with Wieder. The facts and issues in Wieder were far removed from those in the present cases. I do not think that Mr Lemer can derive any direct assistance from that decision for present purposes. That said, the principles on jurisdiction are well established and it is clear that, while jurisdiction is “primarily territorial”, there are exceptions to that general principle. I do not think that it is necessary to add to the complicated and sometimes subtle jurisprudence on that topic for present purposes.

This is because I accept Sir James Eadie’s more fundamental submission that the Respondents were not acting under any power conferred by the HRA at all. Even if one assumes (which Sir James Eadie strongly disputes) that there was “jurisdiction” for the purposes of Article 1 of the ECHR, and otherwise there would be a breach of Article 8 of the ECHR, the fundamental difficulty with Mr Lemer’s submission is that the HRA does not, in section 6, confer any power on a public authority at all. What it does do is to impose a duty, that is a duty not to act in a way which is incompatible with a Convention right.

The relevant power which a public authority will be exercising will arise under some other legislation or under the prerogative. The effect of section 6(1) of the HRA is that ordinarily a public authority will be acting unlawfully if it exercises any power which it has under other legislation or under the prerogative in a way which is incompatible with a Convention right. Section 6(2) goes on to make an exception to that, particularly where there is primary legislation which authorises the Act in question. None of that arises in the present context.

The consequence is that the Respondents were not exercising a statutory discretion in formulating and applying the policy in these cases. The doctrine of fettering of discretion therefore does not apply. Accordingly, I would reject ground 2 in this appeal too.

For the above reasons, and despite the natural sympathy which the Appellants’ cases attract, I would dismiss both of these appeals.

I agree.

I also agree.