ALL THE CITIZENS (R on the application of) v SECRETARY OF STATE FOR DIGITAL, CULTURE, MEDIA AND SPORT & Anor

The Public Records Act 1958 requires arrangements for selecting records that ought permanently to be preserved and for the safe-keeping of selected records. It does not impose a general duty to create records, preserve every public record, or retain communications in a particular form.

The duty leaves substantial discretion, subject to ordinary public-law limits such as irrationality and frustrating the statutory purpose. Policies are not law. Internal policies governing the administration of government departments are not generally enforceable by judicial review, although policies may have legal effect in cases involving individual rights or the exercise of public power.

All the Citizens and Good Law Project brought separate judicial review claims concerning the use of private email, WhatsApp, Signal and auto-delete functions for government business. They alleged breaches of section 3(1) of the Public Records Act 1958 and of governmental policies concerning records and communications. They also challenged the content and consistency of those policies.

The court considered whether the statutory framework required the creation or retention of records, whether internal governmental policies were enforceable as public law, whether the arrangements were irrational, and whether one policy challenge was out of time. The court also dealt with related procedural applications and arguments concerning standing and justiciability.

1. The two judicial review claims were dismissed. The application by All the Citizens to add three defendants was refused. Permission was granted to Good Law Project to rely on the Private Office Papers Guidance, and the defendants’ further evidence was admitted.
2. Section 3(1) of the Public Records Act 1958 imposes a duty to make arrangements for selecting records which ought permanently to be preserved and for the safe-keeping of records selected for that purpose. It is not a duty to preserve records generally, retain records pending selection, or preserve them in a particular form. The Act does not require officials to create a record of every conversation or regulate whether government business is conducted through personal devices or particular communication systems.
3. The statutory duty leaves substantial discretion, but not unlimited discretion. Ordinary public-law principles apply, including irrationality and the principle that a power must not be exercised so as to frustrate the statutory purpose. The loss of an individual message does not, by itself, establish a breach of section 3(1).
4. The Freedom of Information Act 2000 provides access to information actually held by public authorities. It creates no general duty to create or preserve records. Section 77 may apply where information is deleted after an access request with the intention of preventing disclosure. The code under section 46 is guidance and does not create specific duties requiring particular records or communications to be preserved.
5. Policies are different from law and do not generally create legal rights. A failure to follow policy may breach public law where the policy governs the exercise of public power in an individual case, particularly where individual rights are affected. The law has not developed so that all administrative policies are enforceable. Inward-facing policies governing the internal administration of government departments do not generally fall within that category. The court also held that mandatory wording is materially different from wording which merely recommends or advises a course of action. The challenge to the policy permitting auto-deletion therefore failed, including under the approach in R (A) v Secretary of State for the Home Department [2021] UKSC 37.
6. The challenge to the 2013 Cabinet Office Private Email Guidance was an abstract challenge. Under rule 54.5 of the Civil Procedure Rules 1998, the claim had to be brought promptly and in any event within three months of promulgation. It was eight years late, and no extension was granted. The court did not need to determine standing or non-justiciability, although reference to the Ministerial Code did not itself make the security guidance non-justiciable.