CX1 & Ors, R (on the application of) v Secretary of State for Defence & Anor

The Divisional Court considered closed material challenges to a policy response to a large data leak of Afghan Relocations and Assistance Policy (ARAP) applicants. The court applied anxious scrutiny to executive decision-making taken under the royal prerogative and reviewable for irrationality. Relevant legal material included the Justice and Security Act 2013 (section 6 and section 8 applications were granted), the Data Protection Act 2018 and the UK General Data Protection Regulation (articles 4 and 5 and related provisions) which established that the leaked dataset constituted personal data and that there were arguable breaches of data protection obligations. The court held that a categorical rule excluding from relocation anyone who did not claim one of the specifically listed high-profile roles was irrational because it precluded proper individualised consideration of whether particular claimants (notably MP1, a former judge, and CX6, a well-known journalist) held roles that exposed them to the highest risk. The court granted permission for judicial review for MP1 and CX6, quashed the decision (paragraph 2c of the 25 March 2024 decision) insofar as it applied a categorical exclusion, and directed the Secretary of State to reconsider those claimants’ cases. The court expressed concern about the sufficiency of planning for those not prioritised for relocation and emphasised the exceptional national security context, including the existence of a contra mundum super-injunction and the scale of the assessed risk to life.

This closed judgment addresses a challenge to executive decisions made in response to a major data incident in which a dataset containing the personal data of around 25,000 ARAP applicants and their family members (approximately 100,000 people) was disclosed and then further disseminated. The defendants sought and obtained closed material procedures under the Justice and Security Act 2013 and in consequence special advocates were appointed; the special advocates did not oppose the defendants' section 6 and section 8 applications and the court granted them.

Nature of the claim: The proceedings were judicial review challenges brought on behalf of claimants affected by the data incident, seeking to quash decisions that they were not eligible for relocation to the United Kingdom under the ARAP scheme or under the bespoke policy developed in response to the leak. The relief sought included quashing the decision not to include particular claimants within the cohort to be offered relocation and a direction to reconsider their applications.

Background and facts:

• A MoD official inadvertently emailed an unencrypted dataset in February 2022; onward disclosure became apparent by 14 August 2023.
• The Government assessed that the leak created a risk to life and a risk of torture, including a high likelihood that the Taliban would seek and exploit the dataset to target high-profile individuals.
• The Government obtained an exceptional contra mundum injunction and super-injunction to prevent further dissemination and to protect those affected while protective work continued.
• Officials proposed options and Ministers directed development of a targeted cohort policy, evolving from proposals to protect circa 150–200 highest-risk individuals to a later plan (25 March 2024) to offer access to apply for relocation to an estimated highest risk cohort of roughly 2,300 individuals (11,500 with family members) while excluding a large remainder.

Issues framed by the court: (i) whether the policy adopted was irrational; (ii) whether the decision-maker unlawfully fettered discretion by applying the policy as an automatic rule; and (iii) whether the decision-maker failed to take into account relevant personal circumstances of the claimants. The court also addressed contextual issues including the exceptional national security risks, the existence of a super-injunction, and whether the executive’s policy-making under prerogative powers was reviewable and to what standard.

Court’s reasoning: The court accepted that the policy response was ex gratia, grounded in prerogative powers, and therefore not subject to statutory constraints but nevertheless reviewable for irrationality. Applying anxious scrutiny given the risk to life, the court held that it was rational for the Government to prioritise a highest-risk cohort and that practical constraints made relocation of all affected persons impracticable. However, the decision as applied to exclude anyone not claiming one of a narrowly specified list of roles failed to show that relevant individual circumstances (for example, the particulars of MP1 as a former chief judge in Helmand and CX6 as a prominent journalist) had been considered. That categorical exclusion was irrational in its application to those claimants. The court granted permission for judicial review for MP1 and CX6, quashed the relevant part of the 25 March 2024 decision, and ordered reconsideration of their cases. The court declined to quash decisions in respect of claimants not named in the dataset (CX4 and CX7) as speculative. The court also flagged concerns about timeliness and the need for contingency measures for those not prioritised, including financial measures, communications planning for ‘break glass’, and attention to those in third countries who may face refoulement risks.

The court (Divisional Court) allowed in part the special advocates’ challenge. It held that the decision of 25 March 2024 was irrational insofar as it applied a categorical rule excluding from relocation any individual not claiming one of the specified listed roles without giving individualised consideration. For that reason the court granted permission for judicial review for MP1 and CX6, quashed paragraph 2c of the 25 March 2024 decision as applied to them, and directed the Secretary of State for Defence to reconsider their cases. The court reasoned that anxious scrutiny was required because the policy was taken in the context of a substantial risk to life arising from an arguable breach of data protection law and the extraordinary use of a contra mundum super-injunction, and that the categorical exclusion lacked a cogent, reasoned justification as to those claimants.

There is no appellate history of this decision. The judgment records related open judgments in the underlying proceedings: CX cases [2024] EWHC 94 (Admin) and MP cases [2024] EWHC 410 (Admin).