Court finds that policy to relocate high risk individuals from Afghanistan following data leak incident was irrational

In a decision made in April 2024 but only made public now, the High Court quashed decisions made by the Secretary of State of Defence that the claimants were not eligible under the Afghan Response Route because, as a judge and a journalist, they did not work in one of the limited eligible roles. The court held that a “rule which categorically excludes anyone not in the identified roles is irrational in its application to the claimants”.

A CLOSED judgment had been handed down in the case on 19 April 2024, and an OPEN version was published on 8 August 2025. The case is R (CX1 & others) v Secretary of State for Defence & another [2024] EWHC 892 (Admin).

Background

In February 2022, a dataset containing the personal data of around 25,000 Afghan Relocations and Assistance Policy applicants and their family members, totalling 100,000 people was leaked. Having been made aware that part of the data had become available in the public domain, the Ministry of Defence applied for an injunction to prohibit further dissemination of the data set.

On 1 September 2023, Robin Knowles J subsequently granted injunctive relief by way of a super-injunction to prohibit further dissemination of the data set. Several further hearings took place and the court maintained the super-injunction until 15 July 2025 when Mr Justice Chamberlain handed down judgment discharging it.

Afghan Response Route

In response to the data breach, the previous government introduced the Afghan Response Route to allow for certain individuals and their immediate and additional family members to be considered for eligibility for relocation to the UK.

Until the OPEN judgment in CX1 and others was published, the only publicly available information about the Afghan Response Route was the guidance published on the government’s website on 22 July 2025. The guidance set out the following eligibility criteria:

To be found eligible for the ARR, individuals had to be impacted by the data incident; be categorised as at highest risk of targeting by the Taleban, as a result; be located in a high risk country; and not have previously been found eligible under either the Afghan Relocations and Assistance Policy (ARAP), the Afghan Citizens Resettlement Scheme (ACRS) or any other route which provides ‘settled status’ (i.e. Indefinite Leave to Enter (ILE) or Remain (ILR)) in the UK.

On 15 July 2025, the government confirmed that Afghan Response Route had closed on 4 July 2025.

Risk based approach for determining relocation eligibility under the Afghan Response Route policy

On 19 December 2023, a policy paper produced by the Ministry of Defence for the Domestic and Economic Affairs Committee of Ministers (“DEAC”) recommended a risk-based approach for determining eligibility for relocation to the UK. In that paper, caseworkers identified around 3,000 high-profile individuals based on former employment.

Officials proposed adding a condition beyond risk, requiring that prior to the data leak the individual had “worked alongside, in partnership with, closely supporting or assisting a UK Government department, including where that department can corroborate the link.” On its face, this requirement is similar to that contained in category 4 of the Afghan Relocations and Assistance Policy. The criteria included those who would have been excluded from the Afghan Relocations and Assistance Policy on the basis they did not contribute to the UK’s military or national security objectives.

In light of the paper, DEAC agreed it would relocate a targeted cohort of approximately 200 high profile individuals and their dependants who held existing and confirmed links to the UK. It was also agreed that the Ministry of Defence would conduct further work on the possibility of relocating a cohort of 3,000 individuals who were identified in the paper.

A threat assessment was carried out by Ministry of Defence in January 2024. The assessment addressed the following.

31. [In January 2024, an updated threat assessment was carried out by MOD. That covered matters including:

– The Taleban would have an interest in the dataset and would take steps which would lead to their obtaining it.

– The threat to persons whose details are contained in the dataset is that, if identified by the Taleban, they are at risk, including of lethal harm.

– The likelihood that the Taleban will target family members of individuals in the dataset.

– The threat would exist regardless of the eligibility for the ARAP scheme of individuals in the dataset.

– The risk for ARAP cohorts in third countries.][The MOD produced a list containing examples of high-profile roles.]

*(underlining is from the judgment and denotes redactions and rewording of the original judgment)

Although the full roles on the list remain redacted in the OPEN judgment, we do know that MP1 and CX6’s respective roles, namely judge and journalist, were not included in the list.

Officials considered offering the whole cohort of individuals and their family members mentioned in the data set the opportunity to apply for relocation to the UK, amounting to around 100,000 people. The paper acknowledges that this “would most effectively meet the objective of reducing the risk caused by the data leak.”

The paper highlighted the constraints of the approach, namely the practical considerations in individuals relocating from Afghanistan and resettlement in the UK. The cost to relocate the entire cohort, was estimated at £2.5 to £3 billion.  The risk of the data leak becoming known was also mentioned as a potential risk of notifying the entire cohort.  

On 25 March 2024 (the day before the hearing) a meeting between the Ministry of Defence and DEAC took place. DEAC agreed to offer access to the relocation scheme for the cohort at the highest risk as a result of the data incident, comprising an estimated 2,300 individuals, or 11,500 including immediate family members.

The ‘package’ was to mirror the Afghan Relocations and Assistance Policy, meaning that successful applicants would be granted permission to stay in the UK on the same basis as that scheme. It also made provisions to reassess additional family member applications from the highest risk affected Afghan Relocations and Assistance Policy individuals and introduced a provision allowing individuals eligible under the new route to apply for the relocation of their family members.

MP1 was a former high-profile judge and CX6 worked for the BBC World Service. They were found not to form part of the cohort at the highest risk. They brought a judicial review to challenge the decision of 25 March 2024 not to include them within the cohort of people to be relocated to the UK.

The judicial review claim

The claimants argued that the policy underlying the decisions to exclude them was irrational because it was drawn so narrowly that it precluded a case-specific, individualised assessment of risk. The claimants also argued that the decision maker unlawfully fettered their discretion by allowing the policy to automatically determine the outcome of their decision. They submitted that the decision maker failed to take into account relevant considerations, namely the personal circumstances of the claimants, when reaching the decision.

The court began by outlining the context of the defendants’ decision making:

43. There are important contextual features to the first defendant’s decision-making. Most prominent of these are (1) the existence of a risk to life and a risk of torture, to (2) almost 100,000 people, as a result of (3) a strongly arguable breach of the law on the part of the Government, in circumstances where (4) those affected are not aware of what has happened and are disabled from taking action to protect themselves, because (5) the Government has, highly exceptionally, secured a super injunction on the basis of a promise to the court that it would take all practical steps to protect those at risk as soon as possible, in circumstances where (6) the decision-making is fraught with risk and involves the allocation of significant resource, potentially to the detriment of others, and (7) there is no statutory framework regulating the decision-making.

As to (7), the court highlighted that the Afghan Response Route policy was adopted under prerogative powers so there:

was no applicable statutory discretion for the question of an unlawful fettering of discretion to apply. However, the Court noted that decision-making was still ultimately reviewable on grounds of rationality, namely whether the question of whether it is rational to adopt a rigid rule which precludes the consideration of the position of individuals on a case-by-case basis.

The court noted that both parties relied on the Supreme Court judgment of Sandiford v The Secretary of State for Foreign and Commonwealth Affairs [2014] UKSC 44. The court identified that the instant cases, like Sandiford, involved a risk of death and also had the other contextual features identified above.

The court recognised that though the defendant had a very broad discretion when setting and applying the applicable criteria to the claimants, the features outlined above meant that a particularly close analysis was needed to determine whether there were sufficiently cogent reasons justifying the action taken by the first defendant.

The court stated that the first defendant was justified in concluding that it was not practicable to relocate all those at risk to the United Kingdom. The prioritisation of those in roles identified as falling into the highest risk category, while making appropriate alternative provision for the rest, was also justified.

At paragraph 57, it was noted that “the MOD does not exclude the possibility that high-profile individuals occupying other roles may also fall into the same highest risk category. That is because the highest risk category is concerned with those occupying high-profile roles and MOD gives only a non-exhaustive list of examples of such roles.”  The court concluded that it was apparent the first defendant’s decision-making proceeded on the basis that only those who claim to have held one of the specified roles in the list provided by the Ministry of Defence could qualify for relocation.  

There was no consideration to determine whether an individual fell into the highest risk category if they did not do a role on the list. The court highlighted that some information that could have allowed such consideration was readily available to the first defendant because each individual on the dataset had made an Afghan Relocations and Assistance Policy application.

Further, there was no evidence that it would be impracticable to give individual consideration in each case to determine whether another high-profile person, within a role not on the list, falls within the highest risk category. The narrow scope of the policy was held to be irrational in its application to the claimants.

The court also commented that it had concerns for those who were not prioritised for relocation and what would be done for this cohort, particularly in the event that the data leak became publicly known. It was also noted the first defendant had not so far, given sufficient attention to the steps that can and should be taken to protect those who are in third countries and who may be at risk of refoulement.

Conclusion

The judgment sheds a little more light on the Afghan Response Route policy and how it applied to individuals affected by the leak incident. The decision also underscores the importance of an individualised assessment in cases concerning risk of harm from the Taliban.

Martin Goudie KC, Dominic Lewis and Alex Jamieson represented the Claimants in closed proceedings.

Zoe Cooley of Wilson Solicitors LLP represented the MP1 Claimants in their initial judicial review proceedings, instructing Duran Seddon KC and Ali Bandegani of Garden Court Chambers. Leigh Day represented the CX1 Claimants in their initial judicial review, instructing Adam Straw KC  and Catherine Meredith of Doughty Street Chambers.