[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	England and Wales High Court (Administrative Court) Decisions
You are here: BAILII >> Databases >> England and Wales High Court (Administrative Court) Decisions >> All the Citizens & Anor, R (On the Application Of) v Secretary of State for Digital, Culture, Media and Sport & Ors [2022] EWHC 960 (Admin) (29 April 2022) URL: http://www.bailii.org/ew/cases/EWHC/Admin/2022/960.html Cite as: [2022] WLR(D) 221, [2022] WLR 3748, [2022] 1 WLR 3748, [2022] EWHC 960 (Admin)

[New search] [Printable PDF version] [View ICLR summary: [2022] WLR(D) 221] [Buy ICLR report: [2022] 1 WLR 3748] [Help]

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
DIVISIONAL COURT

		Royal Courts of Justice Strand, London, WC2A 2LL
		29 April 2022

Lord Justice Singh :

Introduction

1. This is the judgment of the court, to which both its members have contributed.
2. These two separate claims relate to the use for Government business of non-Governmental ("private") communication systems (particularly WhatsApp, Signal and private email). The Claimants' case is that the use of such systems means that public records that should be retained are instead deleted or are otherwise not available to be preserved for the public record. They say that this is unlawful because (a) it is incompatible with a statutory duty under section 3(1) of the Public Records Act 1958 ("the 1958 Act"); and (b) it amounts to an unjustified breach of policy.
3. The public interest in the preservation of certain public records is not in dispute. What is in dispute is whether there is a legal duty, enforceable by judicial review, to create and maintain records so that they are available for posterity, such that it is unlawful to use some modern methods of communication (such as instant messaging with auto-delete functions). This case also raises a legal issue of principle that has significance beyond the particular context of public records: to what extent are government policies enforceable as a matter of public law?
4. At the hearing we had submissions from Ben Jaffey QC for the First Claimant (All the Citizens or "AtC"), Joseph Barrett for the Second Claimant (Good Law Project or "GLP") and Sir James Eadie QC for the Defendants. We are grateful to them all, and their teams, for their written as well as oral submissions.

Procedural issues

5. There is a number of procedural issues which arise, some of which are not the subject of dispute. It was agreed at the start of the hearing that we would determine such issues as were in dispute after the hearing in this judgment.

Discontinuance of claim by GLP against HM Treasury

6. CPR 38.2(3) provides that, when there is more than one defendant, the claimant may discontinue "all or part of a claim against all or any of the defendants." It does not need the permission of the court to do so but CPR 38.2(1) requires that a claimant must file a notice of discontinuance and serve a copy on every party to the proceedings. Discontinuance takes effect on the date that the notice is served on the defendant: CPR 38.5.
7. At the start of the hearing the Defendants complained that the claim by GLP against HM Treasury had not been pursued but there had been no formal application to discontinue it. We directed that GLP must file a formal notice of discontinuance withdrawing its claim against HM Treasury. We noted that the Defendants submit that costs therefore follow automatically upon discontinuance of that claim. We reserved this matter to a later stage, so that costs can be dealt with compendiously. This does not prevent the Defendants from maintaining their submission that costs follow automatically.

Application by AtC to re-amend its grounds

8. There is an application by AtC for permission to re-amend its grounds. In the main there is no objection by the Defendants. The point which is in dispute is the application to add three new Defendants to the claim and the potential consequence for the costs capping order. The original Defendants to the claim by AtC are, first, the Secretary of State for Digital, Culture, Media and Sport; and, secondly, the Minister for the Cabinet Office. AtC applies to add the Prime Minister, the Secretary of State for Health and Social Care and the Secretary of State for Business, Energy and Industrial Strategy.
9. There are two rules for adding a defendant party to a claim. The general rule is CPR 19.2(2). The court may order the addition of a defendant when either it is desirable to resolve all matters in dispute (19.2(2)(a)) or there is an issue involving the new party connected to the dispute (19.2(2)(b)) and it is desirable to add them. Alternatively, there is a specific rule in CPR 19.5(2) which applies after the end of a relevant limitation period. Under 19.5(2), the addition of a defendant must be "necessary" as defined in 19.5(3): the claim cannot properly be carried on against the original party unless the new party is added as a defendant. The procedure for adding a party is set out in r.19.4. In summary, the court's permission is required and the application must be supported by evidence.
10. AtC submits that its application to amend satisfies either limb (a) or limb (b) of CPR 19.2(2). The Defendants contend that CPR 19.5 is the applicable provision, as the application is made outside the three month limitation period for judicial review proceedings and argue that the "necessity" requirement of that provision is not met; and, in any event, it should fail if considered under CPR 19.2, as it would create in effect new proceedings, nor are the matters connected.
11. As to the limitation argument, it is not self-evident that the limitation period in judicial review proceedings (specified in CPR 54.5) falls within any of the provisions to which CPR 19.5 applies, that is a period of limitation under (a) the Limitation Act 1980 (plainly not) or (c) "any other enactment which allows such a change, or under which such a change is allowed".
12. We do not grant this application by AtC to add three new Defendants. As we understood it, the main purpose of doing so would be to ensure that any remedy granted by this Court is binding on those parties as well as the original two Defendants. In view of the conclusions we have reached below, the issue of remedy will not arise, as we do not consider that there has been any breach of public law in this case. The substantive issues of public law which arise can be determined without adding the three new Defendants.

Application by GLP to amend its grounds

13. There is an application by GLP to amend its grounds, to most of which there is no objection. The one point which is in dispute is whether they should have permission to rely on a document entitled 'Private Office Papers Guidance'. We grant permission to do so. In our view, the interests of justice would be served by considering all the material in the round. We cannot see that this will cause prejudice to the Defendants, since they have been able to deal with the merits of the issue.

Application by the Defendants to adduce further evidence

14. On behalf of the Defendants there was an application to adduce the second witness statement of Lorraine Jackson. No objection was taken to this by either Claimant and so we granted permission at the hearing and formally record that here.

The 'Potemkin' argument by GLP

15. GLP's first ground of claim, as set out in the Claim Form, included an allegation that the Defendants adopted a practice or policy of "conducting Government decision making and record keeping by 'fake' or 'Potemkin' meetings and records, which do not record the true reasons for Government decisions." 'Potemkin' refers to the sham villages in Crimea said to have been built by Grigory Potemkin in the 18^th century to impress Catherine the Great. The allegation is explained in the grounds of claim. It is that officials create sham documents and hold sham meetings (where participants follow a script) so as to create a fake paper trial that can be used to defend subsequent claims for judicial review.
16. The Defendants responded to this allegation in the grounds of resistance and in the evidence that was filed. In GLP's Skeleton Argument no mention was made of the Potemkin claim. Sir James Eadie QC inferred, correctly as it turned out, that the claim had been silently abandoned. At the hearing he complained that this should not have been left to inference and that GLP should have made it clear that the point was abandoned. Mr Barrett said that there was no ground for complaint: it was clear from the absence of reference to the issue in the Skeleton Argument that it had been abandoned, and the Defendants could have asked for clarification.
17. We consider that there is force in the complaint. It should not be left to parties (or, for that matter, the court) to have to infer, from omissions in skeleton arguments, what grounds of claim have been abandoned. If a party no longer pursues a ground of claim, that ought to be made clear to the court and to the other parties. To do otherwise is inconsistent with the obligations to:

(1) help the court to further the overriding objective (which includes identifying the issues at an early stage): see CPR 1.3 and 1.4(2)(b);

(2) ensure that the skeleton argument defines and confines the areas of controversy (CPR Practice Direction 54A, para. 14.2(1), and Administrative Court Judicial Review Guide 2021, para. 19.2.2).

18. This is particularly so in the case of the 'Potemkin' allegation, which was a very serious one, tantamount to an allegation of bad faith.

Factual background

19. AtC was incorporated in 2020. Its objects include "protecting democracy from data-driven disinformation" and "hold[ing] power to account through investigations and litigation."
20. GLP was incorporated in 2020. Its objects (as currently defined – see R (Good Law Project Ltd and Another) v Prime Minister [2022] EWHC 298 (Admin), at paras. 55-56) include "promot[ing] compliance with the law by public and private actors."
21. The Secretary of State for Digital, Culture, Media and Sport has responsibility for supervising the care and preservation of public records. The Minister for the Cabinet Office has policy responsibility for the Freedom of Information Act 2000 ("FoIA") and for government records management.
22. The Defendants have provided witness statements that address the use of private communication systems within Government. In some instances, the witnesses have drawn on information provided by others. One statement is "a collated corporate statement to avoid a number of shorter statements from differing individuals." Another witness had "the benefit of input of colleagues within [The National Archives on] matters within their policy and operational remits." GLP objects to this approach, stating that it does not comply with the obligation to state the source for information or beliefs that are contained in a witness statement: see para. 18.2 of the Practice Direction to CPR Part 32; and also para. 22.1.4 of the Administrative Court Judicial Review Guide 2021.
23. As a general principle, the White Book commentary at 33.2.3 states that failure to give notice of hearsay in civil proceedings (as mandated by CPR 33.2) does not affect the admissibility of the evidence but may be taken into account by the court with regard to costs or the weight to be given to the evidence. Sir Michael Fordham's Judicial Review Handbook (7^th ed., 2020), at para. 17.1.11, cites a number of cases which support the general proposition that the fact that evidence is hearsay does not necessarily make it inappropriate to rely on it.
24. In the present case, so far as concerns the procedures and policies that were in operation at the relevant time, there is no merit in the objection. The sources for the witness' accounts are the policies themselves which have been seen by the witnesses and are, in many cases, exhibited. It is not practical, helpful, or necessary for every individual involved in the development and implementation of those procedures and policies to provide a separate statement.
25. Moreover, a defendant in judicial review proceedings is subject to a duty of candour and co-operation to put all relevant material before the court. Often, a corporate witness statement is a convenient mechanism to do that. Such a statement is not exempt from the requirements of the CPR. There remains an obligation to identify the source of matters of information or belief that are not within the witness' own knowledge. That does not necessarily mean in every case that every individual source must be separately identified. In some cases, it may be sufficient to provide more general information about the process by which the statement has been prepared, rather than identify by name every individual who has provided input. That is so here. Anyway, the interpretation of policy is for the court.
26. Much must also depend on the nature of the precise issue which arises before the court. In judicial review proceedings, factual disputes are rarely ones for the court to determine, since public law is primarily concerned with matters of law, not fact. Having the factual picture described in general terms by way of a corporate statement will often achieve what is needed in a fair and convenient way. On the other hand, if there is a specific dispute of fact and that is material to an issue in judicial review proceedings (for example, if there is an allegation that there was procedural unfairness at a hearing before the Magistrates' Court), the court may well take a much stricter approach to the quality of the evidence it is prepared to admit. In some cases, nothing less than direct evidence by an individual witness will suffice. The present is not such a case.
27. We therefore take account of the general background to the use of communication systems by different Government departments from the Defendants' witness statements.
28. Many people use modern instant communication platforms (such as WhatsApp) for conversations, including workplace conversations, that would previously have been undertaken by telephone or face-to-face. The increase in the use of such platforms was greatly accelerated by the Covid-19 pandemic, the prevalence of home working and the reduced opportunity for face-to-face encounters. Ad hoc conversations that might previously have taken place orally in the corridor or in the margins of meetings came to be conducted by other means, including by use of instant messaging applications. The availability of encryption (for example on WhatsApp) was for many people an advantage as it helps to have confidential conversations. These features are as true of Government as of many other workplaces.
29. Ministers, Special Advisors and other civil servants within the Cabinet Office are provided with Government email accounts and with Government computers, tablets and smart phones. These come pre-installed with a suite of applications ("apps"). Work undertaken using these apps is saved to a shared, encrypted, repository ("the repository"). Emails are automatically exported to the repository, instantaneously. The apps include "Google Chat", which is intended for "ephemeral, logistical or social communications." By default, such communications are automatically deleted after 24 hours. Government mobile devices may be used to download and install pre-approved apps from an authorised Government online store. Apps which have not been pre-approved are blocked and cannot be downloaded. The apps that are authorised include WhatsApp. Another common instant messaging app, Signal, is not authorised by the Cabinet Office for general use.
30. Staff within the Prime Minister's Office ("No 10") are able to access some additional apps. They were able to install Signal on Government devices between 1 September 2021 and 15 December 2021, but this required authorisation on a case-by-case basis.
31. The Cabinet Office's Departmental Records Officer (a role which is shared between two individuals) is responsible for reviewing the content of material saved in the repository for transfer to departmental archives. From the departmental archives, records are considered for transfer to The National Archives after 15 years. Those selected for transfer are reviewed for sensitivity and redacted before being provided to The National Archives.
32. Within the Department of Health and Social Care ("DHSC"), all staff are supplied with a corporate laptop. These are corporately managed and are restricted so that only DHSC approved apps can be used. Staff may also be provided with corporate mobile phones and tablets according to business need. These are provided with access to authorised apps (which do not include WhatsApp or Signal). Staff are permitted to download apps which have not been specifically authorised. The use of all apps is subject to "Acceptable Use" and "Information Management" policies (see paras. 83 – 86 below).
33. It is common ground that some Ministers, civil servants and unpaid Government advisors have: (1) used private email accounts for communications that relate to Government business; (2) used instant messaging platforms such as WhatsApp on private devices for such communications; and (3) made use of auto-delete functions.
34. The evidence shows a number of examples of each of these:

(1) The Prime Minister has used a private email account in order to edit speeches, something that "is done for ease." Once the edits had been concluded, he would send them to a Government email address in his Private Office to action any changes.

(2) WhatsApp messages were exchanged on 24 March 2020 (one day after the Prime Minister announced the first national "lockdown", and two days before the first set of regulations under the Coronavirus Act 2020 came into force). The exchange took place within a WhatsApp group which comprised the Prime Minister, the Secretary of State for Health and Social Care, the Chief Scientific Advisor, the Chief Medical Officer, the Cabinet Secretary, the Director of Communications and the Chief Advisor to the Prime Minister ("the Chief Advisor"). The Chief Advisor sent a message at 12.14pm asking whether they had "the very best people on [Covid] testing." The Secretary of State responded at 12.28pm and said: "Thank you. We will need more people & the very best." The Chief Advisor responded at 12.37pm with the message "M – u said at 915 that antibody testing is with HMT but HMT say DHSC haven't submitted anything yet – can u check with rishi/whoever and get this clarified super-urgent, thx." We were shown further WhatsApp messages that took place on 26 March, 27 March and 3 May 2020. These messages emerged when the Chief Advisor published them in a blog. We make no comment on whether it was appropriate for him to do so, since that is not an issue before this Court.

(3) The authorised Cabinet Office instant chat app automatically deletes messages after 24 hours.

35. The rationale for the use of an auto-delete function is that instant chat messages are intended to be ephemeral (e.g. "I am going to be late for the meeting"), and that there is no good reason to retain such messages. It is recognised that a conversation that starts on an instant message platform may end up including material that does need to be retained. One suggested workaround is that a screenshot can be taken of the messages, and that screenshot can be saved in the corporate repository (e.g. by embedding it in, or attaching it to, an email).
36. In October 2020, Bodley's Librarian, Richard Ovenden, wrote to the Secretary of State for Digital, Culture, Media and Sport. He expressed concern about the use of auto-deletion and messaging services, and made reference to the 1958 Act. The Secretary of State responded, in November 2020, that appropriate arrangements were in place for the selection of records which ought to be preserved. This correspondence was shared with AtC.
37. On 25 March 2021 AtC wrote to the Secretary of State, seeking clarification of the arrangements in place to preserve communications sent via instant messaging, including all relevant guidance. It sent a follow up email on 12 April 2021. It sent a pre-action letter on 26 April 2021.
38. On 25 May 2021 the Secretary of State responded, treating part of the pre-action letter as a request under FoIA. She informed AtC that staff in the Department were provided with an instant messaging service which may be used in preference to email if there is no need to record the communication. The response explained that the messaging service has an option which allows a user to auto-delete at the end of a chat session, and that auto-deletion takes place after 90 days. If the content of a message needed to be saved, a note for the record should be made.
39. On 6 July 2021 the Information Commissioner announced an investigation into the use of private correspondence channels in the DHSC. In doing so, she said:

"the use of private correspondence channels does not in itself break freedom of information or data protection rules. But my worry is that information in private email accounts or messaging services is forgotten, overlooked, autodeleted or otherwise not available when a freedom of information request is later made. This frustrates the freedom of information process, and puts at risk the preservation of official records of decision making."

Material legislation

Public Records Act 1958

40. Section 1 of the 1958 Act, as amended, provides:

"(1) The Secretary of State shall be generally responsible for the execution of this Act and shall supervise the care and preservation of public records.

…

(3) The Secretary of State shall in every year lay before both Houses of Parliament a report on the work of the Public Record Office, which shall include any report made to him by the Advisory Council on Public Records."

41. Under section 2 of the 1958 Act, the Secretary of State may appoint a Keeper of Public Records to take charge under her direction of the Public Record Office and of the records therein. The powers and duties of the Keeper are then set out in section 2.
42. Section 3 of the 1958 Act provides:

"(1) It shall be the duty of every person responsible for public records of any description which are not in the Public Record Office or a place of deposit appointed by the Secretary of State under this Act to make arrangements for the selection of those records which ought to be permanently preserved and for their safe-keeping.

(2) Every person shall perform his duties under this section under the guidance of the Keeper of Public Records and the said Keeper shall be responsible for co-ordinating and supervising all action taken under this section.

…

(4) Public records selected for permanent preservation under this section shall be transferred not later than 20 years after their creation either to the Public Record Office or to such other place of deposit appointed by the Secretary of State under this Act as the Secretary of State may direct:

Provided that any records may be retained after the said period if, in the opinion of the person who is responsible for them, they are required for administrative purposes or ought to be retained for any other special reason and, where that person is not the Secretary of State, the Secretary of State has been informed of the facts and given his approval.

…

(6) Public records which, following the arrangements made in pursuance of this section, have been rejected as not required for permanent preservation shall be destroyed or, subject in the case of records for which some person other than the Secretary of State is responsible, to the approval of the Secretary of State, disposed of in any other way. …"

43. Section 10(1) provides that, in this Act, "public records" has the meaning assigned to it by Schedule 1; and "records" includes not only written records but "records conveying information by any other means whatsoever".
44. Familiar modern methods of communication were not in direct contemplation in 1958. It is, however, common ground that emails and instant messages (whether SMS text messages, WhatsApp messages, Signal messages, or messages sent by other communication apps) are records within the meaning of the 1958 Act if they convey information. And that they are public records if they come within the scope of Schedule 1.
45. Schedule 1 has effect for determining what are public records for the purposes of the 1958 Act. Para. 2 provides:

"(1) Subject to the provisions of this paragraph, administrative and departmental records belonging to Her Majesty, whether in the United Kingdom or elsewhere, in right of Her Majesty's Government in the United Kingdom and, in particular, –

(a) records of, or held in, any department of Her Majesty's Government in the United Kingdom, or

(b) records of any office, commission or other body or establishment whatsoever under Her Majesty's Government in the United Kingdom,

shall be public records. …"

46. Section 5(3) of the 1958 Act provides:

"It shall be the duty of the Keeper of Public Records to arrange that reasonable facilities are available to the public for inspecting and obtaining copies of those public records in the Public Record Office which fall to be disclosed in accordance with the Freedom of Information Act 2000."

Freedom of Information Act 2000

47. Section 1 of FoIA creates a general right of access to information held by public authorities on the making of a written request, which is subject to exemptions which are then set out in the Act.
48. For the purposes of FoIA, information is held by a public authority if (see section 3(2)):

"(a) it is held by the authority, otherwise than on behalf of another person, or

(b) it is held by another person on behalf of the authority."

49. Section 46(1) of FoIA requires the Secretary of State to issue a code of practice providing guidance to relevant authorities as to the practice which it would, in his opinion, be desirable for them to follow in connection with the keeping, management and destruction of their records.
50. Subsection (3) provides that, in exercising his functions under this section, the Secretary of State shall have regard to the public interest in allowing public access to information held by relevant authorities.
51. There is no statutory requirement to have regard to a code of practice issued under section 46.
52. FoIA does not directly give rise to a general duty to record information, or to retain records of information. However, once a person has exercised the right of access to information under section 1, it is, in principle, a criminal offence to delete any record held by a public authority with the intention of preventing its disclosure in response to that request: see section 77.

Interpretation of the legislation

53. In our view, the correct interpretation of the 1958 Act is as follows.
54. First, the duty in section 3(1) is "to make arrangements".
55. Secondly, those arrangements must be for the "selection" of certain records. It is not a duty to preserve records as such.
56. Thirdly, the purpose of the selection envisaged by section 3(1) is that there will be selected records which ought to be "permanently" preserved. This is a duty which is not simply about preservation of records but about their permanent preservation in the national interest.
57. Fourthly, the arrangements required must also be for the "safe-keeping" of those records which are selected for permanent preservation. This duty, when read in its statutory context, is not a duty about keeping records pending the selection of records for permanent preservation. This is a duty which arises after that selection has been made and it is decided to preserve certain records permanently.
58. Fifthly, the right of access in section 5(3) of the 1958 Act is to access such records as fall within that provision and which in fact have been put in the Public Record Office. That may be a long way into the future. In one sense, it could be said that the public right of access in 20 or 30 years time will be impeded if the underlying records are not kept now but that is not a breach of section 5(3).
59. Finally, but importantly in the context of the present case, the 1958 Act itself says nothing about such matters as whether a person can use a personal device to communicate with others about Government business. Nor, as is common ground, does it require the production of a record of something in the first place. For example, if a Minister has a conversation with an advisor in the corridor, there is nothing unlawful about that; and they are not required to create a record of their conversation, even though the subject matter may well be the development of Government policy.
60. It will be clear from the terms of section 3(1) of the 1958 Act that, although couched in terms of being a duty, in the performance of that duty there will in practice be a large measure of discretion involved as to precisely what "arrangements" there should be. It does not follow from the fact that a particular record on a particular occasion may have been destroyed that there has been a breach of the more general duty to have arrangements in place.
61. Before this Court Sir James Eadie (rightly) accepted on behalf of the Defendants that the discretion inherent within section 3(1) is not unlimited. He accepted, as he must, that the conventional principles of public law will govern the exercise of that power, for example irrationality and the Padfield principle, namely that the power must not be exercised in such a way as to frustrate the purpose of the 1958 Act (Padfield v Minister of Agriculture, Fisheries and Food [1968] AC 997). In an extreme case, for example if a public body decided to burn all of its records, there would clearly be a breach of section 3(1) of the 1958 Act, since the purpose of the legislation would be frustrated and that act would be irrational. But Sir James submits, correctly in our view, that what the Act does not do is regulate the minutiae of precisely what must be preserved, or the manner in which public authorities communicate before they reach the stage of selecting records for permanent preservation.
62. Turning to FoIA, it is common ground that the general right of access to information in section 1 does not create a duty to preserve any records. The right which it confers is a right of access to such information as in fact is held by public authorities. If in the meantime a record has not been preserved, that will not be a breach of FoIA. It might be different if this is done to prevent disclosure after a request has been made: that may be a criminal offence under section 77 of FoIA.
63. So far as the code of practice under section 46 is concerned, the duty to have regard to the public interest in allowing public access to information, which is set out in subsection (3), applies only at the stage at which the Secretary of State is considering the contents of the code of practice to be issued. Again, it does not say anything about whether any particular records should be preserved or in what manner or form.
64. Furthermore, the code of practice which is then to be issued under section 46 is expressly to be by way of "guidance" and is to set out the practice which it would, in the opinion of the Secretary of State, be "desirable" for relevant authorities to follow in connection with the keeping, management and destruction of their records. Again, in our judgement, this is very broad language and does not create specific duties which it could be said have been breached when, for example, a Minister uses a personal device to communicate with an official or deletes a message on such a device.

Codes of practice, policies, guidance, advice and notes

65. There is a large number of codes of practice, policies, guidance, advice and notes that have an impact on the use of communication systems and the retention of information by those working within different Government departments. More than 30 have been disclosed in the course of these proceedings. They are not all obviously consistent, either in their substantive content or their terminology. So, for example, a document relating to the use of private email states: "forms of electronic communication [other than Government email systems] may be used in the course of conducting Government business", whereas another states "[y]ou should not use your personal devices, email and communications applications for Government business…" To take another example, the material which should be retained is said, in different places, to be "relevant information" or "important conversations" or "substantive issues".
66. We set out below the key parts of the main guidance documents on which the parties rely.

Statutory guidance

67. (1) The National Archives' Records Collection Policy: This is published statutory guidance issued by the Keeper of Public Records under section 3(2) of the 1958 Act. It therefore sets out, under that statutory authority, guidance as to how those responsible for public records should "make arrangements for the selection of those records which ought to be permanently preserved and for their safe-keeping."
68. It identifies the records that The National Archives "seeks to collect and preserve." These include:

"3.1.1 The principal policies and actions of the UK central government…

Including:

records illustrative of the process of developing government policy and legislation

research and other key evidence upon which policy formulation was based, and records relating to the review and evaluation of policy

records of the interpretation and implementation of policy and the law. This includes records which illustrate changes of direction or provide clarity on the main functions of government

…

3.1.2 The structures and decision-making processes in government

Including:

minutes and papers of Cabinet committees, management boards and other project or working groups across the public sector which have had a discernible impact on policy or events, or where there is likely to be public interest because of the costs involved, risks taken, or impact created

…

3.1.3 The state's interaction with the lives of its citizens

Including:

…

records relating to individuals or national and international events of significant contemporary interest or controversy

…"

69. The guidance also identifies records that will not be collected:

"3.4 Records which will not be collected

Records that do not have enduring historical value (such as internal administration, routine case files or temporary papers) will not be collected by The National Archives. If records do not meet the selection criteria as described above, and would not be useful to research or other local collections, they should be disposed of under a disposal schedule."

70. The guidance thus indicates what records The National Archives seeks to preserve. It says nothing about the circumstances in which it is necessary to create public records. Nor does it say anything about the retention of public records before the point at which a decision is made about permanent preservation. The language of the guidance does not require that it be followed, or taken into account, when decisions are made about the selection of records for permanent preservation. That is consistent with the statutory framework, which likewise does not impose any explicit requirement to follow the guidance or take it into account.
71. (2) Code of practice under section 46 of FoIA: The current code of practice was published on 15 July 2021. It provides guidance "on the keeping, management and destruction" of public records. It states that compliance with its terms "provides authorities with a high level of confidence that they can comply with the requirements of FoIA." It sets out, in highly general terms, the benefits of retaining records and good governance in respect of record keeping. It states:

"2.3 Keeping, finding and using information

2.3.2 Authorities should keep information for as long as it has value; for example if:

…

( the authority has selected it for permanent preservation under [the Public Records Act]…

…

2.3.3 Authorities should be able to collect and keep technical and contextual information about their records in order to understand their value. Metadata should be kept in such a way that it remains reliable and accessible for as long as it is required, which will be at least the life of the records.

2.3.4 Authorities should be able to transfer technical and contextual information to a successor body and, if selected for permanent preservation, to an archive.

2.7 Destroying information

2.7.1 Authorities should destroy or delete information that no longer has value. Destruction decisions should take into account the current value of the information and any potential future value. Destroying information is essential to maintaining an effective information management capability, and means that authorities avoid the necessary financial burden of searching, maintaining and storing information that is no longer needed.

…

2.7.3 Authorities should ensure that staff are aware that there is no need to keep ephemeral material, and this may be destroyed on a routine basis. For example, by deleting trivial emails and messages after they have been read and discouraging staff from keeping multiple or personal copies of documents."

72. Under the heading "Status of the Code and the obligation to comply", the code of practice accurately records that the statutory duty of the Secretary of State is to provide guidance "on the practice which, in the opinion of the Secretary of State, it would be 'desirable for them to follow in connection with the keeping, management and destruction of their records.'" It states that compliance with the code of practice makes it more likely that authorities will comply with other legislation, such as FoIA and the 1958 Act.
73. The code of practice explicitly recognises the benefits of deleting certain records, particularly ephemeral records. The practice of using an auto-delete function for such records is therefore consistent with the code of practice.
74. AtC submits that the practice of sending screenshots of instant messages where they need to be preserved (see para. 35 above) does not comply with the guidance on the retention of metadata (see para. 2.3.3 of the code of practice). However, the evidence filed in these proceedings shows that screenshots can include relevant metadata. The WhatsApp conversations we were shown (by way of screenshots) included the names of the participants and the date and times that each message was sent (and by whom and to whom it was sent). Moreover, the metadata is an integral part of an instant message and is kept for so long as the message is retained. The screenshot is a separate document, and nothing in the code of practice requires that, where a note or screenshot is made of a record, then that note or screenshot must capture all of the record's metadata. If there is some particular need to retain metadata then this could be captured by, for example, narrative text within an email that includes the screenshot.

Non-statutory guidance

75. (3) The National Archives' Guidance principles on the auto-deletion of email: This document is published. It was suggested that it is a statutory policy, but nothing within the guidance says that, and it does not come within the scope of section 3(2) of the 1958 Act (because it does not relate to the arrangements for selecting records for permanent preservation). It provides guidance on the use of auto-deletion functions:

"To delete or not to delete?

Emails of historical value and enduring public interest should be kept

However, email volumes can become unmanageable, leading to real problems. For example:

there is a risk of a breach of the Data Protection Act if emails contain personal or sensitive information

information retained long term in mailboxes may pose more of a security risk

they can be difficult to search and find information in

storage capacity can become limited and costly

Auto-deletion can be a useful tool in managing email volumes. It can reduce the need for manual processes which can often fail due to lack of time, resource and priority

An auto-deletion policy can also encourage users to actively consider which emails have ongoing value and therefore need to be captured in the department's EDRM solution

What are the options? Once you have identified why you need to delete emails the next thing to consider is how to apply this practically. This will differ for each department, currently ranging from 90 days to four years.

Departments should bear in mind that it may not be possible to use a blanket auto-deletion process due to ongoing litigation or inquiry.

The auto-deletion options are:

1. Deal with the ephemeral items first – Set up policies for deleted, sent and calendar items with shorter time periods or allow staff to manage these time periods themselves. This gives the users some flexibility to manage their own inbox – they know that items will be deleted by default after two years but can assign shorter periods to certain folders that they know will not be required as long.

…

4. Email is not the only option – Where appropriate make use of instant messaging, collaboration areas and intranets to exchange and share information. Although these present their own challenges for the management of information they may be suitable for short term correspondence, announcements or knowledge sharing where retention of a permanent record is not required."

76. (4) The National Archives' Management of Private Office Papers Guidance: This guidance is also published, and is also, on our construction of section 3(2) of the 1958 Act, outside the ambit of that provision. It applies to "all information which is created in any medium" including instant messages in Ministers' Private Offices. The Guidance explains:

"The records that need to be created by the Private Office will largely be concerned with the meetings and telephone conversations relating to official business that take place during the normal course of a Minister's day. In general records should be created of all meetings/events which take place with Ministers and/or officials present where decisions are taken on departmental or government policy and/or there is follow up action required."

77. (5) The Cabinet Office Private Email Guidance: This is non-statutory general guidance, which is concerned with the use of private emails within Government departments. It says that departments should comply with the statutory code of practice (see paras. 71 - 74 above). It provides the following guidance:

"Use of non-Government email systems for Government business

7. Civil servants and Ministers are generally provided with access to Government email systems. Other forms of electronic communication may be used in the course of conducting Government business. Departments' security policies will apply when generating and communicating information. The originator or recipient of a communication should consider whether the information contained in it is substantive discussions or decisions generated in the course of conducting Government business and, if so, take steps to ensure the relevant information is accessible (e.g. by copying it to a government email address).

8. The decision about whether information was generated in the course of conducting Government business cannot always be clear cut. No single factor will determine whether information amounts to government information as opposed to for example personal or political information. It will be important to consider the relevant circumstances and in doing so, it may be helpful to bear in mind the following factors:

a. Who are the originator and recipients of the information? This will not necessarily be determinative but if, for example, the sender and recipients are civil servants then this might suggest that the email amounts to Government business.

b. In what capacity were the originator or recipients acting? For example, Ministers can act in several different capacities – as members of the Government, as constituency MPs, and as members of a political party.

c. What function was the information being provided for? For example, was it to inform a substantive policy discussion or a particular decision and if so, what was the nature of that discussion or decision? Was the information being generated directly to inform or influence the development or implementation of departmental policy or the operation of the department? Should the information form part of the public record? An exchange which mentions a department's policy area (e.g. commenting, expressing views, or discussing wider political ramifications) does not necessarily amount to Government's official business. However, if it was intended that the department would use or act on the information in the course of conducting its business that may well point to the information being Government information."

78. (7) Security of Government Business: This is an unpublished "aide memoire" for Ministers. It has not been disclosed as such in these proceedings, because it includes advice on security matters that are not relevant to any issue in the case. It contains the following advice:

"Your personal IT will not be as secure as Departmental IT. You should not use your personal devices, email and communications applications for Government business at any classification."

79. The Ministerial Code includes a requirement to comply with the Security of Government Business aide-memoire.
80. (8) The Cabinet Office Information and Records Retention & Destruction Policy: This states:

"Under the Public Records Act 1958, we are required to capture, identify and permanently preserve any information, which demonstrates accountability."

81. This is not, even on the Claimants' case, an accurate account of the impact of the 1958 Act.
82. The policy makes the following provision in respect of instant messaging:

"4.5. Instant Messaging

Instant messaging is provided to all staff and should be used in preference to email for routine communications where there is no need to retain a record of the communication.

Instant messages history in individual and group chats must be switched off and should not be retained once a session is finished. If the content of an instant message is required for the record or as an audit trail, a note for the record should be created and the message content saved in that. For example, written up in an email or in a document created in a word processor which is itself saved into the relevant drive.

Contents of instant messaging are subject to FOI and Data Protection searches and the Public Records Act."

83. (9) The Cabinet Office Information and Records Management Policy: This states:

"3.2 Approved Records Repositories

Information and records will only be stored in approved repositories in accordance with Departmental Security policies and held in appropriate formats and systems based on their security classification. This is to ensure information and records that may be relied upon as an audit trail for the department can be properly maintained and managed as a corporate asset. The DRO is responsible for approving repositories, which must facilitate and not hinder the department in carrying out its legal obligations, and issuing guidance on the use of repositories. Non authorised repositories must not be used including personal email, and the DRO must be consulted at an early stage of any technology change that will have an impact on information and records."

84. It contains a standards framework, which includes requirements that "[n]o official work should be stored only in a personal drive, laptop or in an email account", and "[i]mportant emails are not left in individual accounts, unshared/saved for longer than one month".
85. (10) The Department of Health and Social Care ("DHSC") Information Management Policy: This states:

"You should not use a personal email account for business conducted on behalf of the department. Auto-forwarding of emails is not permitted and is disabled in Open Service. Any exception to this rule is in exceptional circumstances only and requires agreement of the DHSC Information and Security Team.

…

You are required under the Public Records Act to save emails that are needed to demonstrate decisions, actions and use of resources for the record. Such emails should be placed on the records management system, Information WorkSpace (IWS).

…

Information WorkSpace and shared drives

The Department's policy is that material that needs to be retained for the record should be stored in IWS, if the format of the material is able to be placed there…"

86. (11) DHSC Acceptable Use of ICT Policy: This policy sets out the "behaviours expected by and required of users of [DHSC] IT." It states that breaching the guidance may result in disciplinary action. It says this about "Devices, Systems and Networks":

"Using enabled DHSC mobile devices, staff will be able to download applications from the Apple store to the DHSC mobile device for their use on the device itself. Although the download of apps will be at the discretion of the user, staff should ensure they do not:

…

• download or seek to access materials that are extremist in nature, offensive, indecent or obscene (including abusive images and materials) or related to dating applications;

• use, or seek to use, any applications to circumvent management or security controls.

…

In addition, users should:

• Only use systems, applications, software and devices which are approved, procured and with configuration managed by DHSC when undertaking official business (including work-related email), and apply DHSC standards and guidance in their use.

• Only use approved DHSC devices connected to DHSC network(s) when undertaking official business.

…

• Ensure no official information is stored on devices without DHSC security controls."

87. (12) The DHSC Private Office Papers Guidance: This states:

"To ensure information can be found and reused, Private Offices need to:

• Move any information to folders in IWS.

• Ensure that there is at least one trained IWS Local Folder Manager within each team

…

Telephone conversations, instant messaging and text discussions that are of an official nature must be recorded in the appropriate IWS file. This can be done by creating either an email or a word document and saving this into IWS."

88. (13) WhatsApp Use on No 10 Phones: This undated document was issued in March 2021 to staff working at No 10. It says:

"You may now use WhatsApp on your No10 phone, with some limitations. This is to enable more effective and agile working and to minimise the need to use personal phones for work purposes.

…On our No10 phones WhatsApp can be used for things like:

- Confirming who is in the office

- Confirm a time for a meeting

- Confirm receipt of a document

- If travelling with the PM, you might message colleagues to say that the event went well and that you are on route back to the office

- Arranging staff social activities

WhatsApp chat should NOT:

- Include any discussion about detailed policy or policy development

- Confirm the PMs location, dates, route or future travel plans.

If you find a chat is unexpectedly developing into a more sensitive conversation, you should move the chat onto the No10 IT system and continue it there.

Staff are required to save a record of any conversations that should form part of the OFFICIAL record or otherwise may give rise to any FOI, Public Records Act or similar data protection legislation requirements such as GDPR…"

89. Ms Sarah Harrison, of the Cabinet Office, says that No 10 also permits "incidental use of WhatsApp on private devices for unclassified, ephemeral information" but that this is subject to the policy requirements to ensure that "substantive matters" are recorded on Government systems.

The legal significance of policies

90. In R (A) v Secretary of State for the Home Department [2021] UKSC 37; [2021] 1 WLR 3931, at paras. 2-3, Lord Sales JSC and Lord Burnett of Maldon CJ set out the following summary:

"2. It is a familiar feature of public law that Ministers and other public authorities often have wide discretionary powers to exercise. Usually these are conferred by statute, but in the case of Ministers they may derive from the common law or prerogative powers of the Crown, which fall to be exercised by them or on their advice. Where public authorities have wide discretionary powers, they may find it helpful to promulgate policy documents to give guidance about how they may use those powers in practice. Policies may promote a number of objectives. In particular, where a number of officials all have to exercise the same discretionary powers in a stream of individual cases which come before them, a policy may provide them with guidance so that they apply the powers in similar ways and the risk of arbitrary or capricious differences of outcomes is reduced. If placed in the public domain, policies can help individuals to understand how discretionary powers are likely to be exercised in their situations and can provide standards against which public authorities can be held to account. In all these ways, policies can be an important tool in promoting good administration.

3. Policies are different from law. They do not create legal rights as such. In the case of policies in relation to the exercise of statutory discretionary powers, it is unlawful for a public authority to fetter the discretion conferred on it by statute by applying a policy rigidly and without being willing to consider whether it should not be followed in the particular case. However, in an important development in public law in the last decades, the courts have given policies greater legal effect. In certain circumstances a policy may give rise to a legitimate expectation that a public authority will follow a particular procedure before taking a decision and it may give rise to a legitimate expectation that the authority will confer a particular substantive benefit when it does decide how to exercise its discretion. In these cases, the courts will give effect to the legitimate expectation unless the authority can show that departure from its policy is justified as a proportionate way of promoting some countervailing public interest. If the policy is not made public, and an affected individual is unaware of its relevance to his case and in that sense has no actual expectation arising from it, the authority may still be required to comply with it unless able to justify departing from it: Mandalia v Secretary of State for the Home Department [2015] 1 WLR 4546. Under some conditions the holder of a discretionary power may be required to formulate a policy and to publish it: R (WL (Congo)) v Secretary of State for the Home Department (JUSTICE intervening) [2012] 1 AC 245. Thus, policies have moved increasingly centre stage in public law." (Emphasis added)

91. As Lord Sales and Lord Burnett went on to say, at para. 39, policies "come in many forms and may be more or less detailed and directive depending on what a public authority is seeking to achieve by issuing one." They constitute guidance issued as a matter of discretion by a public authority to assist in the performance of public duties. They are issued to promote practical objectives thought appropriate by the public authority. There is often no obligation in public law for an authority to promulgate any policy and there is no obligation, when it does promulgate a policy, for it to take the form of a detailed and comprehensive statement of the law in a particular area. As they said at para. 40, "policies often serve useful functions in promoting good administration."
92. The particular issue which was before the Supreme Court in A was the basis on which a court can intervene to hold that a policy is unlawful. The answer to that question depends on whether the policy in question authorises or approves unlawful conduct by those to whom it is directed: see para. 38. In this case, the Claimants rely on that proposition in so far as their grounds challenge the content of certain of the Defendants' policies.
93. But most of the Claimants' grounds do not challenge the content of policies; rather, they complain that the policies were not complied with and there was no good reason for this. The mainstay for the submissions of the Claimants in that regard is the decision of the Supreme Court in Mandalia v Secretary of State for the Home Department [2015] UKSC 59; [2015] 1 WLR 4546. That, like many of the cases in this area, was an immigration case, although it was not a detention case as many of the earlier authorities have been. The legal effect of policies was set out by Lord Wilson JSC as follows, at paras. 29-31:

"29. In 2001, in R (Saadi) v Secretary of State for the Home Department [2002] 1 WLR 356, para 7 Lord Phillips of Worth Matravers MR, giving the judgment of the Court of Appeal, said: 'The lawful exercise of [statutory] powers can also be restricted, according to established principles of public law, by government policy and the legitimate expectation to which such policy gives rise.' Since 2001, however, there has been some departure from the ascription of the legal effect of policy to the doctrine of legitimate expectation. Invocation of the doctrine is strained in circumstances in which those who invoke it were, like Mr Mandalia, unaware of the policy until after the determination adverse to them was made; and also strained in circumstances in which reliance is placed on guidance issued by one public body to another, for example by the Department of the Environment to local planning authorities: see R (WL (Congo)) v Secretary of State for the Home Department [2010] 1 WLR 2168, para 58. So the applicant's right to the determination of his application in accordance with policy is now generally taken to flow from a principle, no doubt related to the doctrine of legitimate expectation but free-standing, which was best articulated by Laws LJ in R (Nadarajah) v Secretary of State for the Home Department [2005] EWCA Civ 1363 at [68]:

'Where a public authority has issued a promise or adopted a practice which represents how it proposes to act in a given area, the law will require the promise or practice to be honoured unless there is good reason not to do so. What is the principle behind this proposition? It is not far to seek. It is said to be grounded in fairness, and no doubt in general terms that is so. I would prefer to express it rather more broadly as a requirement of good administration, by which public bodies ought to deal straightforwardly and consistently with the public.'

30. Thus, in R (WL (Congo)) v Secretary of State for the Home Department [2012] 1 AC 245 (in which this court reversed the decision of the Court of Appeal but without doubting the observation in para 58 for which I have cited the decision in para 29 above), Lord Dyson JSC said simply, at para 35:

'The individual has a basic public law right to have his or her case considered under whatever policy the executive sees fit to adopt provided that the adopted policy is a lawful exercise of the discretion conferred by the statute.'

There is no doubt that the implementation of the process instruction would have been a lawful exercise of the power conferred on the Secretary of State by section 4(1) of the Immigration Act 1971 to give or vary leave to remain in the UK.

31. But, in his judgment in the WL (Congo) case, Lord Dyson JSC had articulated two qualifications. He had said, at para 21: 'it is a well established principle of public law that a policy should not be so rigid as to amount to a fetter on the discretion of decision-makers.' But there was ample flexibility in the process instruction to save it from amounting to a fetter on the discretion of the caseworkers. Lord Dyson JSC had also said, at para 26, 'a decision-maker must follow his published policy … unless there are good reasons for not doing so.' But the Secretary of State does not argue that there were good reasons for not following the process instruction in the case of Mr Mandalia. Her argument is instead that, properly interpreted, the process instruction did not require the caseworker to alert Mr Mandalia to the deficit in his evidence before refusing his application. So the search is for the proper interpretation of the process instruction, no more and no less. Indeed in that regard it is now clear that its interpretation is a matter of law which the court must therefore decide for itself: R (SK (Zimbabwe)) v Secretary of State for the Home Department (Bail for Immigration Detainees intervening) [2011] 1 WLR 1299, para 36, Lord Hope of Craighead DPSC). Previous suggestions that the courts should adopt the Secretary of State's own interpretation of her immigration policies unless it is unreasonable, made for example in Gangadeen and Jurawan v Secretary of State for the Home Department [1998] Imm AR 106, 115, are therefore inaccurate."

94. As will be apparent from that passage, the origins of the recent development in the law relating to policies lies in cases which were concerned with detention of an individual. To some extent this development was influenced by the incorporation of the European Convention on Human Rights ("ECHR") into domestic law through the Human Rights Act 1998 ("HRA"). This is because it is a requirement of the ECHR that an interference with a Convention right (for example the right to personal liberty in Article 5) must be prescribed by law. It is well-established in the jurisprudence of the European Court of Human Rights that this does not always require law in the sense of legislation or other rules of law; it may sometimes be satisfied by the existence and publication of policies which govern the exercise of a discretionary power.
95. It must also be borne in mind in this context that the starting point is that any interference with a person's personal liberty will, at common law, be a tort, typically false imprisonment. For that interference with liberty to be lawful, the defendant must be able to point to some lawful authority to detain a person. Frequently they will be able to point to a discretionary power which has been conferred by legislation, for example the Immigration Act 1971. But that authority may itself be vitiated by a public law error. This is the context in which the alleged failure to act in accordance with a policy has played a crucial role: see e.g. R (WL (Congo)) v Secretary of State for the Home Department [2011] UKSC 12; [2012] 1 AC 245. That case concerned a policy which governed the substantive criteria for detention. In R (Kambadzi) v Secretary of State for the Home Department [2011] UKSC 23; [2011] 1 WLR 1299, the Supreme Court (by a majority) applied that principle also to the context of a policy which governed procedural matters rather than substantive criteria for detention. It is instructive to see how the legal principle was set out by Lord Hope of Craighead DPSC, at paras. 49-52. In particular, at paras. 51-52, Lord Hope said:

"51. The question then is what is to be made of the Secretary of State's public law duty to give effect to his published policy. In my opinion the answer to that question will always be fact-sensitive. In this case we are dealing with an executive act which interferes with personal liberty. So one must ask whether the published policy is sufficiently closely related to the authority to detain to provide a further qualification of the discretion that he has under the statute. Unlike the 2001 Rules, chapter 38 of the manual is concerned with the lawfulness of the detention. That is made clear in the opening paragraphs: see para 18 above. It has been designed to give practical effect to the Hardial Singh principles to meet the requirement that, to be lawful, the measures taken must be transparent and not arbitrary. It contains a set of instructions with which officials are expected to comply: see paragraph 1(3) of Schedule 2 to the 1971 Act. As I see it, the principles and the instructions in the manual go hand in hand. As Munby J said in para 68, the reviews are fundamental to the propriety of continued detention. The instructions are the means by which, in accordance with his published policy, the Secretary of State gives effect to the principles. They are not only commendable; they are necessary.

52. The relationship of the review to the exercise of the authority is very close. They too go hand in hand. If the system works as it should, authorisation for continued detention is to be found in the decision taken at each review. References to the authority to detain in the forms that were issued in the appellant's case illustrate this point. Form IS 151F, which is headed 'Monthly Progress Report to Detainees', concludes at the top of p 3 of 3 with the words 'Authority to maintain detention given', on which the officer's comments are invited and beneath which his decision is recorded. The discretion to continue detention must, of course, be exercised in accordance with the principles. But it must also be exercised in accordance with the policy stated in the manual. The timetable which para 38.8 sets out is an essential part of the process. These are limitations on the way the discretion may be exercised. Following the guidance that R (Nadarajah) v Secretary of State for the Home Department [2004] INLR 139 provides (see paras 39 and 40 above), I would hold that if they are breached without good reason continued detention is unlawful. In principle it must follow that tortious remedies will be available, including the remedy of damages."

96. It is also instructive to see how the principle was approached by Lord Brown of Eaton-under-Heywood JSC in his dissenting judgment, at para. 107. Both Lord Hope and Lord Brown regarded the relevance of the policies in question as constraining the grounds on which an executive power (a power of detention in that case) would be exercised.
97. From the above authorities we derive the following principles.
98. The fundamental starting point is that policies are different from law and do not create legal rights as such: see R (A) v Secretary of State for the Home Department, at para. 3.
99. Secondly, policies often serve useful functions in promoting good administration: see e.g. para. 40 in the same judgment.
100. Thirdly, there are undoubtedly situations in which a failure to comply with a policy (without good reason) will constitute a breach of public law but, to date, those cases have been concerned with interferences with individual rights: see WL (Congo); Kambadzi; and Mandalia.
101. It may well be that, as the law develops in its usual incremental way in this area, other contexts will arise in which a breach of a policy (without good reason) will give rise to a breach of the law as well. It may be that, although there is no interference with individual rights as such, a policy has been promulgated to govern the exercise of a discretionary power which may confer a benefit of significant value to an individual, for example naturalisation as a British citizen. But such cases would still be ones in which there is an administrative decision by a public authority, exercising public powers, in relation to an individual case.
102. In our judgement, public law has not reached the stage at which all administrative policies have become enforceable as a matter of law. Policies come in various forms and their content is wide-ranging. Some policies, such as those in the present context, are essentially inward facing and govern the way in which a public authority will conduct its own affairs. They do not concern the exercise of public powers. To that extent, we accept the submissions for the Defendants.
103. We do not, however, accept Sir James Eadie's submission at its widest, when he suggested that the dictum in Lord Diplock's speech in CCSU should be regarded as definitive in modern public law. In Council of Civil Service Unions v Minister for the Civil Service [1985] AC 374, at 408, Lord Diplock said:

"To qualify as a subject for judicial review the decision must have consequences which affect some person (or body of persons) other than the decision-maker, although it may affect him too. It must affect such other person either:

(a) by altering rights or obligations of that person which are enforceable by or against him in private law; or

(b) by depriving him of some benefit or advantage which either (i) he had in the past been permitted by the decision-maker to enjoy and which he can legitimately expect to be permitted to continue to do until there has been communicated to him some rational grounds for withdrawing it on which he has been given an opportunity to comment; or (ii) he has received assurance from the decision-maker will not be withdrawn without giving him first an opportunity of advancing reasons for contending that they should not be withdrawn."

104. We would make several observations about that dictum. First, the words of a judge, however eminent, should never be read as if they were set out in a statute. Lord Diplock did not suggest otherwise. His words must be read, as always, in the context of the particular case in which they were uttered. In R v Secretary of State for the Environment, ex parte Nottinghamshire County Council [1986] AC 240, at 249C-E, Lord Scarman said that the ground upon which the courts will review the exercise of administrative discretion by a public officer is "abuse of power." He went on to state that the speech of Lord Diplock in CCSU provides a "valuable" but "certainly not exhaustive analysis of the grounds upon which courts will embark on the judicial review of an administrative power exercised by a public officer".
105. Secondly, as a technical matter, what qualifies as a subject for a claim for judicial review is now governed by the CPR 54.1(2)(a): (i) an enactment or (ii) a decision, action or failure to act in relation to the exercise of a public function. While the paradigm case of a decision which is amenable to judicial review will be one which affects the rights or duties of an individual, it is clear from the cases which have been decided ever since CCSU that judicial review may be available in many other contexts, for example in a challenge to the legality of the content of a policy (as Sir James Eadie himself recognises).
106. Furthermore, we consider that the Claimants are right to submit that the essential basis for judicial review lies not so much in rights but in wrongs in the sense of the unlawful exercise of public power. Lord Reed JSC explained the correct position in AXA General Insurance Ltd v HM Advocate [2011] UKSC 46; [2012] 1 AC 868, at para. 159:

"… Putting the matter broadly, in an ordinary action in private law the pursuer is seeking to vindicate his rights against the defender. The right on which the action is founded constitutes his title to sue. … An application to the supervisory jurisdiction, on the other hand, is not brought to vindicate a right vested in the applicant, but to request the court to supervise the actings of a public authority so as to ensure that it exercises its functions in accordance with the law."

107. Although that passage was in the context of a Scottish appeal, the principles on standing to bring judicial review proceedings have now been assimilated with the principles in England and Wales, as the Supreme Court has made clear. If Sir James Eadie were correct in his submission that the subject of a claim for judicial review must necessarily concern an interference with individual rights, there would be no room for the wider principles of standing, which have recognised (for example) that a person whose rights are not affected may nevertheless have standing to bring a claim for judicial review. The question of standing is analytically distinct from the question of what may properly be the subject of judicial review.
108. It is in this context that, in our view, the celebrated dictum of Sedley J in R v Somerset County Council, ex parte Dixon [1998] Env LR 111, at 121, should be understood:

"Public law is not at base about rights, even though abuses of power may and often do invade private rights; it is about wrongs – that is to say misuses of public power …"

109. Nor, in the present context, do we need to address Sir James Eadie's submissions about justiciability. In our view, this is not on proper analysis a case of non-justiciability. We shall have to return later to the specific issue about the Ministerial Code and the Security of Government Business guidance but, more generally, the policies with which we are concerned would not in principle be non-justiciable. The reason why the Claimants' submissions fail is on the more fundamental ground that these policies are not enforceable as a matter of public law in the first place. There are several good reasons why this should be so.
110. First, these are policies which govern the internal administration of Government departments and do not involve the exercise of public power.
111. Secondly, the broad submissions advanced by the Claimants do not sit easily with the fundamental principle of public law that guidance is precisely that and need not be "slavishly followed". That has been well-established in many contexts such as planning law (Edinburgh City Council v Secretary of State for Scotland [1997] 1 WLR 1447 per Lord Hope of Craighead at 1450C).
112. Thirdly, it is frequently the case that Parliament itself has set out to what extent a document such as a policy, a code or guidance must be taken into account by a public authority. Often (but not always, as we have seen above) it will be something which must be taken into account and may have relevance to whether there has been a breach of the law but it will not by itself be a breach of the law to fail to comply with such a document (for example the Highway Code issued under section 38 of the Road Traffic Act 1988 (see section 38(7)), and the codes of practice issued under section 66 of the Police and Criminal Evidence Act 1984 (see section 67(10)). If the Claimants' broad submissions were to be accepted, this would make no sense of those specific statutory provisions.
113. Fourthly, our analysis does not lead to the result that there is no accountability for non-compliance with Governmental policies of the type with which this case is concerned. If there is a suitable issue for the Information Commissioner to investigate and determine, that can be done. If there is maladministration, that may be something about which complaint can be made to the Parliamentary Commissioner for Administration ("Ombudsman"). If there is a breach of a policy concerned with employment matters (e.g. bullying or harassment), this may give rise to internal grievance or disciplinary proceedings or may even give rise to a legal cause of action in the Employment Tribunal. We must also bear in mind the constitutional doctrine of ministerial responsibility, in other words responsibility to Parliament. This is not intended to be an exhaustive list but what it indicates is that it is not always necessary that accountability for breach of policy must lead to legal enforceability in the courts as a matter of public law.
114. Fifthly, there would be a real risk that (if public law were to regard such policies as being enforceable as a matter of law in the courts) public authorities would be deterred from adopting such policies. That would be detrimental to the interests of good administration. As the Supreme Court said in R (A), there are important public interests in good administration which are served by the adoption of policies such as these; but, in our view, it would not be in the public interest for them to be enforceable as a matter of law in the courts.
115. The final point we would make in the present context is that the kind of policy which will be enforceable as a matter of public law (unless there is good reason to depart from it) should, in principle, be the kind of policy which the Supreme Court had in mind in R (Friends of the Earth Ltd) v Secretary of State for Transport [2020] UKSC 52; [2021] PTSR 190, in particular at paras. 105-107 (Lord Hodge DPSC and Lord Sales JSC). As they said there, the epitome of "Government policy" is a formal written statement of established policy. One reason for this is that civil servants and others must be able to identify the policy which is said to be legally enforceable quickly and conveniently. It is important in this context that there should be legal certainty. Although the issues in that case were not the same as those before us, we think that some guidance can be obtained from the approach taken by the Supreme Court in that case. They said that the criteria for a relevant "policy" in the context of section 5(8) of the Planning Act 2008 were those applicable for a legitimate expectation: a statement qualifies as a policy only if it is clear, unambiguous and devoid of relevant qualification.
116. Against that analysis of principle, we will address the various authorities that were cited by the Claimants to persuade us that that analysis is wrong.

Authorities relied on by the Claimants

117. On behalf of AtC Mr Jaffey relied in particular on four decisions, which he submits, support his contention that policies can be enforceable as a matter of public law even where they do not affect individual rights or otherwise involve the exercise of public power in individual cases. We will consider those four decisions and will then turn to other authorities that were cited on behalf of the Claimants.
118. The first decision is that of Sedley J in Dixon. But that decision long pre-dated the recent developments in public law relating to the enforceability of policies (in particular WL (Congo)). The issue in Dixon was standing, not the legal enforceability of a policy. When Sedley J addressed the merits of the application (which was a renewed application for leave to bring an application for judicial review), at pages 121-125, in the result he in fact refused the application.
119. The second decision was that of the Court of Appeal in R (Corner House Research) v Secretary of State for Trade and Industry [2005] EWCA Civ 192; [2005] 1 WLR 2600. But that was a case concerned with costs, in particular with what was then called a "protective costs order" (before legislation on cost capping orders was enacted in the Criminal Justice and Courts Act 2015). It was in the context of such orders that the Court noted that there is a public interest in the elucidation of public law by the higher courts in addition to the interests of the individual parties: see para. 70 (Lord Phillips of Worth Matravers MR, giving the judgment of the Court). Furthermore, the particular context of that case was far removed from the present. As the Court explained at para. 140:

"… It is in our judgment a matter of general public importance if a division of a department of state publishes and adopts an open consultation policy of general application and then reverts to a time worn practice of privileged access, particularly on an issue as obviously sensitive as measures to combat bribery and corruption in connection with the attainment of major contracts abroad."

120. The third decision was that of the Supreme Court in R (Palestine Solidarity Campaign Ltd) v Secretary of State for Housing, Communities and Local Government [2020] UKSC 16; [2020] 1 WLR 1774. In our view, that case was not concerned with the legal issue which arises in the present cases at all. It was not concerned with the enforceability of a Government policy as a matter of public law. There was a challenge to guidance which was issued by the Secretary of State to local authorities in relation to their pension schemes. The majority of the Supreme Court held that the guidance was unlawful. This was essentially on Padfield grounds. This is apparent from the summary of the relevant legal principles at paras. 20-22 in the judgment of Lord Wilson JSC.
121. Fourthly, we should refer to the decision of the Court of Appeal in R (Project Management Institute) v Minister for the Cabinet Office [2016] EWCA Civ 21; [2016] 1 WLR 1737. But, as Richards LJ noted at para. 37, it was common ground in that case that a decision may in principle be amenable to judicial review on grounds of departure from a published policy and reference was made to the decision of the Supreme Court in WL (Congo). The issue in that case, as Richards LJ went on to explain in the same paragraph, was whether the claimant in that case had a "sufficient interest" to bring the claim for judicial review, in other words the dispute was about standing. Disagreeing with the judge at first instance, the Court of Appeal concluded that it did have standing because, as a competitor claiming that it would be adversely affected by the grant of a charter, it had sufficient interest to challenge the lawfulness of the decision to recommend such a grant. It was therefore a case about the exercise of a public power in an individual case and, therefore, fits into the analysis we have set out above. In that context, a policy may be enforceable as a matter of law.
122. The next case which we must consider is the decision of Chamberlain J in R (Good Law Project Ltd) v Secretary of State for Health and Social Care [2021] EWHC 346 (Admin); [2021] PTSR 1251. That case concerned judicial review proceedings challenging the Secretary of State's failures to comply with procurement law and policy in relation to public contracts for goods and services awarded following the onset of the Covid-19 pandemic. One of the issues concerned the transparency policy: see para. 22. The transparency policy "advised" that contracts should be published within 20 days following the award of the contract or the end of the standstill period. At para. 127, Chamberlain J said that:

"Failure to follow published policy, absent good reason for departing from it, is an established ground for judicial review. The proposition is well-established …"

For that proposition he cited the decisions of the Supreme Court in WL (Congo) and R (Lee-Hirons) v Secretary of State for Justice [2016] UKSC 46; [2017] AC 52, in particular at paras. 17 and 50. In construing the transparency policy in that case Chamberlain J said that the obligation to comply with it (absent good reason to depart from it) was not attenuated, for three reasons, only two of which need to be addressed here. First, there is no uniform drafting style for the policies adopted by public bodies. Some talk about what the public body "should" or "must" do, some "recommend" and others "advise" a particular course of action. He expressed the view that:

"When drafting policy, there is generally no need to distinguish strictly between the mandatory and the hortatory because policy can always be departed from for good reason." (para. 129)

With respect, we are not so sanguine about this. In our view, it may be of significance precisely how a policy is formulated. This is because policy is primarily by, and for the use of, the public authority which devises it. The difficulty with the suggestion that policy can always be departed from for good reason is that (as was common ground for us) the arbiter of what is a good reason is the court and not the public authority whose decision is being reviewed. In our view, as a matter of principle, a policy which is expressed in mandatory terms is different from one which simply recommends or advises a course of action. It is difficult to see how an advisory policy can be said to be "breached" at all.

123. The second reason given by Chamberlain J, at para. 130, was that some policies, by their own terms, will leave a measure of discretion or leeway to the decision-maker. He rightly observed that, in such a case, a decision-maker acting under the discretion or within the leeway will not need to supply a good reason for departing from the policy, because he will be acting within its terms. He was also right to observe that whether any particular policy confers such a discretion or leeway is a matter of construction and (as is now well-established in decisions of the Supreme Court) the construction of a policy is a matter of law and is therefore a matter for the court to decide.
124. The next case which we must consider is the decision of the Supreme Court in Lee-Hirons. That case applied the principle in WL (Congo) but was concerned with an individual's rights. It concerned the decision of the Secretary of State to recall a restricted patient to hospital. It concerned a published policy on such recall and also concerned the demands of Article 5(2) of the ECHR. In that case it was conceded that the adoption of the policy created a public law duty to comply with it, absent good reason: see e.g. para. 50 (Lord Reed JSC). It was another case about the detention of an individual. It is, in our view, far removed from the present context.
125. At the hearing before us Mr Jaffey placed particular reliance on the decision of the House of Lords in R (Munjaz) v Mersey Care NHS Trust [2005] UKHL 58; [2006] 2 AC 148. That case concerned a code of practice issued by the Secretary of State under section 118(1) of the Mental Health Act 1983. That provision imposes a duty on the Secretary of State to prepare, and from time to time revise, a code of practice for the "guidance" of registered medical practitioners and others in relation to the admission of patients to hospitals and mental nursing homes under the Act. Subsection (2) provides that the code shall, in particular, specify forms of medical treatment which "in the opinion of the Secretary of State give rise to special concern". Mr Jaffey emphasises that the statutory language in that case was similar to the language of section 46 of FoIA in the present case. Nevertheless, he points out that the House of Lords held that, as a matter of domestic public law and even leaving aside any issues under Article 5 of the ECHR, the guidance had to be given "great weight" and was "much more than mere advice which an addressee is free to follow or not as it chooses." At para. 21, Lord Bingham of Cornhill said that it was guidance which any hospital should consider with great care, and from which it should depart only if has "cogent reasons for doing so." Further, in reviewing any challenge to a departure from the code, the court should scrutinise the reasons given "with the intensity which the importance and sensitivity of the subject matter requires." See in similar terms, the speech of Lord Hope at para. 69.
126. It seems to us that, important though Munjaz undoubtedly is, the context was very different: that concerned the seclusion for continuous lengthy periods of a long-term psychiatric patient compulsorily detained in a high security hospital.
127. Furthermore, we accept the submission made by Sir James Eadie that not all kinds of guidance or policy will be treated as being analogous to the code of practice which was in issue in Munjaz: see the decision of the Court of Appeal (Sir Terence Etherton MR, Irwin LJ and Singh LJ) in R (Campaign Against Arms Trade) v Secretary of State for International Trade [2019] EWCA Civ 1020; [2019] 1 WLR 5765, at para. 150. This point highlights again that, in our view, it is important to keep in mind that policies can come in many forms and vary widely in their content.
128. Against that framework of principle, we can now address the grounds of challenge in each of the claims before us quite briefly.

Grounds of challenge in the AtC case

129. The grounds of challenge for which AtC has been granted permission are subdivided into Grounds 1A-1C.
130. In his written and oral submissions, Mr Jaffey chose to advance Ground 1C first. This alleges that there was a failure to comply with policies regarding use of personal devices/accounts and instant messaging applications. In the light of the conclusions we have reached on the legal enforceability of such policies, we reject this ground.
131. Ground 1A alleges that there was a failure to comply with policies through use of automatic deletion. Again, in the light of the conclusions we have reached above, we reject this Ground.
132. Ground 1B is different in kind because it alleges that the content of one of the policies is itself unlawful. The challenge is to para. 4.5 of the Cabinet Office Retention/Destruction Policy (see paras. 80 - 82 above), which states:

"Instant messaging is provided to all staff and should be used in preference to email for routine communications where there is no need to retain a record of the communication. Instant messages history in individual and group chats must be switched off and should not be retained once a session is finished. If the content of an instant message is required for the record or as an audit trail, a note for the record should be created and the message content saved in that. For example, written up in an email or in a document created in a word processor which is itself saved into the relevant drive.

Contents of instant messaging are subject to FOI and Data Protection searches and the Public Records Act."

133. It is submitted that this policy positively authorises or approves unlawful conduct and is therefore unlawful in accordance with the decision of the Supreme Court in A, at para. 38. The contention appears to be based on the requirements of section 3(2) of the 1958 Act. We reject that contention. For the reasons we have given above, on our interpretation of that Act, it does not prohibit automatic deletion. There is no specific provision to which the Claimant has been able to point which indicates that it does.
134. Next, Mr Jaffey complains that, under this policy, metadata will not be preserved and this is contrary to the code of practice. We have already rejected that interpretation of the code but, in any event, such an argument would not meet the high threshold required by the decision in A, at para. 38. What is required is a breach of the law, not simply a breach of a code of practice.
135. Further, in any event, we do not interpret the policy, when read as a whole, as being contrary to any legal obligation on the Defendants. It makes it clear that it is concerned with "routine communications where there is no need to retain a record of the communication". This is expressly contrasted with where the content of an instant message "is required for the record or as an audit trail", in which case it should be written up in an email or in a document saved into the relevant drive. In all the circumstances, we cannot see that anything in this policy breaches the law.

Grounds of challenge in the GLP case

136. On behalf of GLP it is submitted that the evidence demonstrates that there have been significant and widescale breaches of public law because there is a widespread practice of using non-Governmental communication systems without any good reason to do so and without taking proper and effective steps to retain the public records thereby created (Ground 1). Ground 1 is then sub-divided by reference to numerous specific events, which are said to breach various policies. It is also submitted that the Defendants' "arrangements" are materially inconsistent as between themselves, materially deficient in a number of respects, and fail to comply with or lawfully give effect to the duty in section 3(1) of the 1958 Act (Ground 2).
137. Under Ground 1 it is submitted that the Defendants have breached their obligations (i) in their own policies; and (ii) under section 3(1) of the 1958 Act.
138. We reject the first of those submissions for the reasons which we have given above as to the legal enforceability of the relevant policies.
139. So far as section 3(1) of the 1958 Act is concerned, we also reject that submission. As we have said above, the duty under section 3(1) is one to make arrangements. That leaves a wide margin of discretion to the relevant body. The submission that, on individual occasions, a particular message has not been preserved does not get close to establishing a breach of the duty to make arrangements in section 3(1). As the Defendants correctly submit, Parliament did not impose any duty in section 3(1) to retain public records, still less in any particular form or in any particular way.
140. Ground 2 challenges the lawfulness of the Defendants' policies as failing to comprise lawful arrangements for the purposes of section 3(1) of the 1958 Act because of (i) material contradictions/inconsistencies between them; and (ii) material deficiencies. We reject these submissions. The first way in which the argument is put is simply not one that is good as a matter of public law. This is for the reasons we have given above about the legal enforceability of policies.
141. We do not accept the second way in which the argument is put either. On our interpretation of the duty in section 3(1) of the 1958 Act, there has been no breach of the law. The only way in which such an argument could have succeeded is if the arrangements which the Defendants have made are irrational as a matter of public law. That would be a high hurdle to overcome and it has not been overcome in the present case.
142. We also reject Ground 2 insofar as it concerns the adequacy of the 2013 Cabinet Office policy, on grounds of delay: see below.

Justiciability

143. In the light of our conclusions, we need only address briefly an argument that was raised by Sir James Eadie in relation to one particular policy: the guidance on Security of Government Business (see paras. 78 – 79 above). Sir James submits that that policy is not justiciable in a court of law because compliance with it is required by the Ministerial Code and that Code is not justiciable (so he submits).
144. A helpful but (as we read it) non-exhaustive summary of the principles of non-justiciability was given in a joint judgment by Lord Neuberger PSC, Lord Sumption JSC and Lord Hodge JSC in Shergill v Khaira [2014] UKSC 33; [2015] AC 359, at paras. 41-43. They observed that there is a number of rules of English law which may result in an English court being unable to decide a disputed issue on its merits. They referred to the concept of non-justiciability as referring to "a case where an issue is said to be inherently unsuitable for judicial determination by reason only of its subject matter." Such cases generally fall into one of two categories. The first category comprises cases where the issue in question is beyond the constitutional competence assigned to the courts under our conception of the separation of powers. The Court said that such cases are "rare, and rightly so, for they may result in a denial of justice which could only exceptionally be justified either at common law or under Article 6 of the [ECHR]." They said that the paradigm cases are the non-justiciability of certain transactions of foreign states and of proceedings in Parliament. Clearly those examples are not relevant in the present context.
145. At para. 43, the Court said that the basis of the second category of non-justiciable cases is quite different. This category comprises claims or defences which are based neither on private legal rights or obligations, nor on reviewable matters of public law. Examples include "domestic disputes; transactions not intended by the participants to affect their legal relations; and issues of international law which engage no private right of the claimant or reviewable question of public law."
146. The present case does not concern domestic disputes or transactions not intended to affect legal relations; nor issues of international law. Nevertheless, Sir James Eadie submits that the subject matter of the Ministerial Code of Practice is non-justiciable and that, since it refers to the guidance on Government security, any alleged breach of that guidance is also non-justiciable.
147. In that context Sir James Eadie submits that, although the outcome in R (First Division Association) v Prime Minister [2021] EWHC 3279 (Admin); [2022] 4 WLR 5 was that the claim failed and therefore the Government were not able to appeal, he does not accept all of the reasoning of the Divisional Court (Lewis LJ and Steyn J) in that case. In that case the Divisional Court held that, although the interpretation of parts, perhaps most, of the Ministerial Code would not be justiciable because they involve political matters (such as references to collective Cabinet responsibility) or ministerial relations with Parliament, there were other aspects of the Code which were justiciable: see paras. 39-42. The Court concluded (at para. 39) that there is a need to focus "not on the source but on the particular subject matter." At the end of para. 42, the Court expressed itself this way:

"We are satisfied that the particular issue is justiciable."

148. In the present context, in our view, the mere fact that the guidance on Security of Government Business is referred to in the Ministerial Code does not render the issue non-justiciable. If otherwise we had accepted the Claimants' submissions, we would not have rejected these claims on the ground of non-justiciability. For reasons we have explained already, however, the claims fail at an earlier stage, because the policies invoked are not enforceable as a matter of public law.

Standing of GLP

149. On behalf of the Defendants Sir James Eadie submits that GLP, but not AtC, lacks standing to bring its claim for judicial review. The Defendants were given permission to raise this argument, although it was raised relatively late in the day, on 8 March 2022.
150. In view of the conclusions which we have reached on the merits of the present claims, it is unnecessary for us to decide the question of standing. At most, it would arise at the stage of considering whether any relief should be granted. On any view, we are well past the stage of the permission for bringing a claim for judicial review in the first place: see section 31(3) of the Senior Courts Act 1981. In view of the conclusion we have reached on the substantive claim, the issue of remedies does not arise in any event.
151. The legal principles governing standing to bring a claim for judicial review were recently considered by the Divisional Court (Singh LJ and Swift J) in R (Good Law Project Ltd and Runnymede Trust) v Prime Minister and Ors [2022] EWHC 298 (Admin): see paras. 16-29 and 53-59. It is unnecessary for this Court to say more about those principles in this judgment.
152. It will suffice for present purposes for us simply to observe that, although we can see some force in the submissions made on behalf of the Defendants, we are not convinced that there is an adequate, principled distinction to be made between the standing of GLP as compared with AtC. It may be that, in the light of the observations of the Divisional Court in the Good Law Project and Runnymede Trust case and the Court of Appeal in R (Good Law Project Ltd) v Minister for the Cabinet Office [2022] EWCA Civ 21, at para. 6, greater attention needs to be paid to the issue of standing in future cases and, as appropriate, should be considered at the permission stage before a claim for judicial review is allowed to proceed. As the Divisional Court reiterated in Good Law Project and Runnymede Trust, at para. 29, the question of standing goes to the Court's jurisdiction and jurisdiction cannot be conferred by the consent of the parties.

Delay

153. The Defendants oppose GLP's challenge to the Cabinet Office Private Email Guidance on the grounds that the claim is out of time. When we granted permission to bring this claim for judicial review, we directed that "the grant of permission does not limit the Defendants' ability to argue at the substantive hearing that the challenge to the lawfulness of the Cabinet Office's 'Guidance to departments on use of private emails' is out of time."
154. The Cabinet Office Private Email Guidance was published in 2013. The claim seeks to challenge the Guidance itself, rather than any decision made under the Guidance. In R (Badmus) v Secretary of State for the Home Department [2020] EWCA Civ 657; [2020] 1 WLR 4609, at para. 62, the Court of Appeal (Sir Terence Etherton MR, Hickinbottom LJ and Simler LJ) distinguished between claims brought by someone who had been affected by a decision made under secondary legislation, and challenges to secondary legislation itself:

"Before us the parties are agreed, as they were before the Judge, that the correct approach is that expressed by the Divisional Court in [R (DSD) v Parole Board [2018] EWHC 694 (Admin), [2019] QB 285] at [167] as follows:

'167. … We agree with the claimants that there is a distinction between cases where the challenge is to a decision taken pursuant to secondary legislation, where the ground to bring the claim first arises when the individual or entity with standing to do so is affected by it, and where the challenge is to secondary legislation in the abstract. …an example of a case falling into the second category is R (Cukurova Finance International Ltd) v HM Treasury [2008] EWHC 2567 (Admin)'

It is convenient to refer to those two categories, as specified in DSD, as "the person specific category" and "the abstract category". There is no binding authority, at the level of the Court of Appeal or above, approving or disapproving the distinction made between those two categories in DSD."

155. In Badmus the case fell within "the person specific category." Here, however, the challenge is made to the Guidance itself. Albeit that is not secondary legislation, this is still a challenge in "the abstract category." The grounds for bringing the claim arose at the time that the Guidance was promulgated, in 2013. A claim for judicial review must be brought promptly, and in any event within three months after the grounds to make the claim first arose: see CPR 54.5(1).
156. Mr Barrett contended that there is a fundamental difference between a challenge to a policy, and a challenge to secondary legislation. He said that the maintenance of a policy that is incompatible with the statutory framework is "a continuing act." The same might, however, be said of secondary legislation. We do not consider that there is the fundamental difference for which Mr Barrett contends.
157. It follows that the claim is out of time by eight years. There is no application under CPR 3.1 to extend the time to bring a claim. In any event, we would decline to extend the time to bring a claim, having regard to the length of the delay, the (as we have found) lack of merit in the underlying challenge and the fact (as we were told) that the Guidance is due to be replaced shortly in any event.

Conclusion

158. For the reasons we have given these two claims for judicial review are dismissed.