R (AFA & Ors) v Secretary of State: Afghan data breach relocation policy upheld

The Court of Appeal has dismissed challenges to the government's relocation policy following a significant data breach that exposed details of Afghan nationals who worked with British forces. In R (AFA & Ors) v Secretary of State for the Home Department [2025] EWCA Civ 825, the court upheld the government's decision to limit relocation to those in high-profile roles, rejecting arguments that the policy was irrational or unlawfully fettered discretion.

The appeals arose from a data incident that placed Afghan nationals at risk. The appellants, who had worked with British forces but did not qualify under the narrowed relocation criteria, challenged the policy on two principal grounds: irrationality in drawing the eligibility line at high-profile roles, and unlawful fettering of discretion in applying the policy.

The rationality challenge

Lord Justice Singh, delivering the leading judgement, acknowledged the gravity of the situation and the "most anxious scrutiny" required when potential risk to life is at stake. The court recognised that the risk had arisen partly from the British government's mistaken conduct. Nevertheless, it held that the respondents were rationally entitled to draw the line where they did.

The court emphasised that its role was not to determine where the line could be drawn, but whether the actual line drawn was rational. With approximately 20,000-25,000 individuals on the list—potentially affecting 80,000-100,000 people including family members—there was no obligation to relocate everyone. The policy, amended following the Divisional Court judgement in CX1, confined relocation to high-profile roles. The court concluded this approach could not be said to be unlawful.

Prerogative powers and fettering of discretion

The second ground raised a more nuanced question about the legal basis for the policy. The appellants contended that the respondents had unlawfully fettered their discretion by creating an inflexible policy. However, the doctrine against fettering only applies where a statutory discretion exists—it cannot arise where power derives from the royal prerogative, as established in R (Sandiford) v Secretary of State for Foreign and Commonwealth Affairs [2014] UKSC 44.

Counsel for the appellants argued that the Immigration Act 1971 provided the statutory basis for the policy, noting that section 33(5) should be construed narrowly to exclude prerogative powers in this context. Relying on R (Alvi) v Secretary of State for the Home Department [2012] UKSC 33, it was submitted that immigration control powers are now "entirely the creature of statute".

The court rejected this analysis. Lord Justice Singh distinguished the authorities cited, noting they did not concern circumstances remotely comparable to the present data incident. Drawing on R (Marouf) v Secretary of State for the Home Department [2023] UKSC 23, the court held that whilst the exercise of powers to control leave to enter and remain is statutory, the formation and adoption of the background relocation policy properly constituted an exercise of the prerogative.

This distinction proved crucial. The policy operated in two stages: the Ministry of Defence determined initial eligibility, whilst the Home Office subsequently issued entry clearance. Only at the final stage did statutory powers under the 1971 Act engage. The MOD's stage one assessment clearly did not derive from the Immigration Act.

The court also noted practical considerations. Were the policy purely statutory, the eligibility criteria would require publication in the Immigration Rules and Parliamentary scrutiny under section 3(2) of the 1971 Act. Given the security-sensitive nature of the criteria, this was neither possible nor appropriate.

The appellants' alternative argument based on section 6 of the Human Rights Act 1998 faced a fundamental difficulty: that provision imposes a duty not to act incompatibly with Convention rights, but confers no independent power. Any relevant power would derive from other legislation or the prerogative.

Both Lady Justice Nicola Davies and Lady Justice Elisabeth Laing agreed with Lord Justice Singh's reasoning. Despite expressing natural sympathy for the appellants' circumstances, the court unanimously dismissed both appeals, finding no basis to interfere with the government's policy response to the data breach.