QP1 & Anor, R (on the application of) v Secretary of State for The Home Department & Anor

A policy responding to a large-scale data breach may lawfully prioritise applicants whose roles create a high-profile risk, including persons in other roles presenting an equivalent risk. Applying such a policy does not ordinarily require an individualised assessment of every applicant’s general risk. The policy defines which considerations are relevant to the decision-maker.

Where relocation assistance is provided under the Royal Prerogative on a gratuitous basis, there is no general public-law duty to mitigate the consequences of the breach by providing relocation or financial assistance to particular individuals. Judicial review of such a policy response is limited where it involves difficult assessments of risk and allocation of resources.

The claimants, Afghan nationals, sought relocation or other assistance following the compromise of QP1’s personal data in the Data Incident. They challenged the Secretary of State for Defence’s refusal to provide assistance outside the Afghan Relocations and Assistance Policy.

Grounds 1 and 2 alleged that it was irrational to conclude that QP1 was not a high-profile person, or a person facing an equivalent level of risk. A proposed Ground 3 alleged a positive obligation to provide notice and non-relocation financial assistance. The court considered the effect of the Divisional Court’s decision in CX1 and the application of the policy to the claimants.

1. Disposition. Permission to apply for judicial review was granted on Grounds 1 and 2, but those grounds were dismissed. Permission to amend and pursue Ground 3 was refused. Permission to appeal was left for the Court of Appeal to determine on the suggested compelling-public-interest basis.
2. Following CX1, it was lawful for the Government to prioritise applicants affected by the Data Incident who performed specified high-profile roles, or other high-profile roles carrying an equivalent risk. The policy was designed to address the inability to make an individualised assessment of the risks faced by every affected applicant and the need to allocate limited resources. The decision-maker was therefore entitled to treat the policy criteria as defining the relevant considerations.
3. The refusal decision faithfully applied that lawful policy. QP1 was not within a specified high-profile role and was not shown to face an equivalent risk. His previous activities, alleged misperception as a spy, Shia faith and Hazara heritage did not make the assessment irrational. His circumstances were materially different from the high-profile examples considered in CX1.
4. There was no public-law basis for requiring case-specific financial assistance. The assistance and policy response were undertaken under the Royal Prerogative on a gratuitous basis, rather than pursuant to a legal duty. The Government was not under a duty to mitigate damage caused by the Data Incident. Operational and risk considerations also weighed against the proposed assistance.
5. The response involved difficult policy-making concerning risk and resources. The court’s supervisory role was consequently limited, and no arguable basis for judicial review was disclosed by the proposed amended Ground 3.

This was a first-instance judicial review. The court granted permission on Grounds 1 and 2 and dismissed them, refused permission on the proposed Ground 3, and left any application for permission to appeal on a compelling-public-interest basis to the Court of Appeal.