Security, the Sussexes and Sir Geoffrey’s Judgments on the Duty to Follow Policies – UK Constitutional Law Association

Public authorities are imbued with statutory and prerogative powers. And every now and then, they publish a policy setting out how they will exercise those powers. Policies must not be so rigid that they amount to a fetter on the discretion of decision-makers. But provided there is ample flexibility so as not to fetter, then the free-standing principle described in Mandalia v Home Secretary [2015] UKSC 59 (Mandalia) can kick in to impose a duty on the public authority to act in accordance with that policy unless there is good reason not to do so.

This principle became the central focus in R (Duke of Sussex) v Home Secretary [2025] EWCA Civ 548 (Duke of Sussex) — a legal battle about the security arrangements for Prince Harry when he comes to the United Kingdom.

Duke of Sussex is one of two major Court of Appeal decisions — together with R (Good Law Project) v Prime Minister [2022] EWCA Civ 1580 (GLP) — since Mandalia that have examined and clarified the scope and application of the public law duty to follow promulgated policy. Sir Geoffrey Vos MR took part in the leading judgments in both decisions. This article examines the growth of the duty to follow policies, the two decisions in question, reflects on the operation of the duty and addresses a popular critique that judges lack restraint.

The Growth of the Duty

So how did this public law duty all begin? It grew initially out of the doctrine of legitimate expectations and the understanding that guidance is integral to the ‘mature process of public administration’. To citizens, they see ‘carefully drafted and considered statements’ published by the government as representing government policy. Those whose lives are governed by a policy are entitled to rely on the expectation that those policies will be followed, not left to speculate about hidden booby-traps. This was encapsulated in the dissenting speech of Lord Steyn in Re McFarland [2004] UKHL 17 at [24]. His Lordship described policies as ‘soft laws’ that are an ‘important source of rights and corresponding duties’. As citizens are often led to believe that government policy ‘will be observed in decision-making unless there is good reason to depart from it’, they are ‘entitled to ask in a court of law whether he fairly comes within the language of the publicly announced policy’.

If Lord Steyn planted the seeds, then the principle grew roots in R v Mersey Care NHS Trust, ex p Munjaz [2006] 2 AC 148 (Munjaz). The House of Lords was considering a Code of Practice on the use of seclusion for psychiatric patients. Lord Bingham rejected the notion that decision-makers are completely free to follow policies as they choose. Rather, the Code was ‘guidance [that] any hospital should consider with great care, and from which it should depart only if it has cogent reasons for doing so’: at [21]. And in any challenge, ‘the court should scrutinise the reasons given’ for a departure. In a similar vein, Lord Hope said that decision-makers ‘must give cogent reasons if in any respect they decide not to follow it’ and that those reasons ‘must be spelled out clearly, logically and convincingly’: at [69].

If roots were growing, then R (Nadarajah) v Home Secretary [2005] EWCA Civ 1363 (Nadarajah) can be said to have watered the plant, by supplying it with a grounding principle. That case concerned the Third Country Family Links Policy. After reviewing the authorities on legitimate expectations, Laws LJ set out at [68] the frequently approved statement that ‘[w]here a public authority has issued a promise or adopted a practice which represents how it proposes to act in a given area, the law will require the promise or practice to be honoured unless there is good reason not to do so.’ This principle, he said, is grounded in fairness and is a ‘requirement of good administration, by which public bodies ought to deal straightforwardly and consistently with the public’. A failure or refusal to comply is permitted only when it is ‘objectively justified as a proportionate measure’, ‘having regard to a legitimate aim pursued by the public body in the public interest’.

It is against the background of these decisions that Mandalia was decided. That case concerned a process instruction directed to officials dealing with student visa applications. The claimant was unaware of the process instruction when the decision was made. In these circumstances, it was unduly ‘strained’ to use the language of ‘expectation’. Lord Wilson held at [29] that, although ‘related to the doctrine of legitimate expectations’, the ‘right to the determination of his application in accordance with policy’ is taken from a ‘free-standing’ principle. His Lordship affirmed that an individual has ‘a basic public law right to have his or her case considered under whatever policy the executive sees fit to adopt provided that the adopted policy is a lawful exercise of the discretion conferred by the statute’.

In Mandalia, the central issue was whether the process instruction required the caseworker to seek evidence from the applicant before refusing their application. In light of the principle that the proper construction of a policy is a matter of law that courts can determine for itself. On this narrow question, the Court held that the process instruction required the caseworker to alert the applicant to bank statements missing from a series and afford him the opportunity to correct it. As the government did not argue that there were good reasons for departing from the process instruction, the Home Office’s refusal of his visa application was quashed.

GLP and the WhatsApp Messages

Mandalia and its precursors left several questions open. One of them was whether the duty to follow policies applied to every policy that the government promulgates. After all, there is a wide variety of policy statements in operation in government — ranging from the National Planning Policy Framework that is clearly public facing and made after consultation to workplace policies regulating the social media use by an agency’s employees. Some guidance documents contain sweeping, ambitious goals for the future, whilst others detail specific considerations that decision-makers exercising public power should consider. Are all of them enforceable under a public law duty?

The GLP case involved a WhatsApp group containing the Prime Minister, Health Secretary and senior officials that exchanged automatically deleting messages during the first national COVID-19 lockdown. The Good Law Project claimed that there were breaches of eight internal government policies. All those policies were directed internally at staff or ministers about the storage, retention and handling of records and the use of electronic devices. But the content of those policies was wide-ranging. Some were sweeping (one document applied to ‘all information which is created in any medium’) and others were very specific (one saying that a ‘WhatsApp chat should NOT:—Include any discussion about detailed policy or policy development’ and that ‘[s]taff are required to save a record of any conversations’). And across the policies, there contained statements that appeared contradictory — one document stated that the ministers ‘should not use your personal devices… for Government business at any classification’, but another said that some ‘forms of electronic communication may be used in the course of conducting Government business’.

Sir Geoffrey Vos MR, Dingemans and Elisabeth Laing LJJ held that there was no legal duty to comply with the eight policies. They emphasised that the policies were directed to ministers and civil servants. These eight policies ‘govern the internal administration of Government departments and do not involve the exercise of public power, and are not about individual cases or the rights of an individual’: at [59]. In that sense, the Court appears to distinguish Mandalia on the basis that that case involved ‘some form of dealing with the public’: at [58]. Indeed, the types of policy that are likely to attract a duty to comply are ‘those that are the epitome of Government policy’: at [65].

The Court made several additional points. It explained that there is a ‘fundamental principle of public law that guidance need not be slavishly followed’ and the policies could not be read as a coherent whole. It considered that it is not the constitutional role of the courts to ‘attempt to micromanage how the executive conducts its affairs in the selection and preservation of documents, or in the use of communications technology by ministers and officials’: at [60]. It observed that the policies were expressed as ‘guidance’ or ‘arrangements’ and were thus not ‘the sort of policies which are or should be subject to a duty to comply enforceable by way of a claim for judicial review’. The Court concluded that there was a ‘real risk’ that, if the policies were legally enforceable, public authorities would be deterred from adopting them: at [64].

Duke of Sussex and the Sussex Family’s Security

Another question left open by Mandalia is what constitutes a ‘good reason’ for departing from a published policy. Nadarajah suggested a proportionality test by looking to whether the decision-maker is pursuing a legitimate aim in the public interest. Lord Hope in Munjaz appeared to suggest a stringent standard: the reason for so departing must be cogent, clear, logical and convincing. But Lord Bingham emphasised that the judicial scrutiny for the reasons of a departure should be carried out ‘with the intensity which the importance and sensitivity of the subject matter requires’. So what is the test? Or, to put it another way, what is a ‘good reason’? And should issues about national security be subject to a more forgiving test?

Duke of Sussex involved a decision of the Executive Committee for the Protection of Royalty and Public Figures (RAVEC), which is responsible for deciding ‘which individuals should receive…protection measures at public expense and to what level’. After Prince Harry decided to step back from Royal duties and live principally in North America, RAVEC changed his protective security to a bespoke arrangement for his future visits to the UK. That arrangement provided a lesser level of protective security than the arrangements that he received when he was a working Royal. Prince Harry said in an interview that this arrangement made it ‘impossible’ for him to bring his family back to the UK safely. In performing its functions, RAVEC was required by its Terms of Reference (ToR) to undergo a process where RAVEC’s Risk Management Board (RMB) conducts a risk analysis and then RAVEC evaluates that analysis to determine the protective security measures proportionate to the assessed risk. But no risk analysis from RMB was commissioned in Price Harry’s case.

RAVEC thus failed to follow the letter of the ToR. Mr Justice Lane in the High Court ([2024] EWHC 418 (Admin) at [166]–[178]) found that the RAVEC Chair considered a RMB risk analysis to be unnecessary given the introduction of the bespoke arrangement, which involved establishing arrangements on a case-by-case basis. He found that there was a good reason for the departure and the decision was not unlawful. Prince Harry appealed and the sole legal question before the Court of Appeal was whether RAVEC had a good reason.

Sir Geoffrey Vos MR, with whom Bean and Edis LJJ agreed, held that the intensity by which courts scrutinise the reasons for departing from a policy lies on ‘a spectrum’ determined by reference to two factors — the nature of the policy itself and the deference that the court ought to pay to the decision-maker: at [67]–[68]. On the first factor, the ToR was neither informal nor just in the form of guidance; it was not published nor the subject of public consultation; the policy is ‘politically highly sensitive’; it concerned an area of national importance peculiarly in the expertise of law enforcement, RAVEC and the Royal Household; it was not public facing but it brought with it government and democratic accountability: at [65], [68]. On the second factor, weight should be attached to a specialist, experienced decision-maker; the decision concerned questions of national or Royal security; and the court must be careful not to usurp the functions of decision-makers: at [66], [68].

After calibrating — or, to use Joanna Bell’s words, tailoring — the intensity of its scrutiny, Sir Geoffrey determined that there was good reason to depart from the ToR for four reasons. First, the ToR was ‘inward facing and unpublished’ in an area of national importance: at [70]. Secondly, in this area of high political sensitivity, the Court has considerable respect for a decision-maker ‘whose expertise and experience in the field of Royal protection is probably unrivalled’: at [71]. Thirdly, the contemporaneous documents had shown that the Chair of RAVEC had confirmed with the RMB that no further risk analyses were required given the alternative arrangements to be established on a case-by-case basis: at [72]. Lastly, the Chair’s evidence gave compelling reasons for the conclusion that the appropriate course was to establish the bespoke arrangements and it is impossible to say that this reasoning was illogical or inappropriate: at [73]. ‘Indeed,’ Sir Geoffrey noted, ‘it seems sensible’.

Sir Geoffrey concluded that Prince Harry’s disagreement with RAVEC over the security that he has been provided on subsequent visits to the UK did not support a legally sustainable public law claim to vitiate the decisions: at [74].

A Lack of Restraint?

The duty to follow policies was criticised for placing too little restraint on judges. Christopher Forsyth said that ‘there is so much uncertainty that there is a real danger that the concept of legitimate expectations will collapse into an inchoate justification for judicial intervention’. However, a closer look at the recent leading authorities suggests that these criticisms have not been borne out and may have been overstated. I argue that the courts show more restraint than these criticisms imagine by first synthesising the case law and explaining how restraint is built into judicial review of this duty.

Whenever a claimant challenges an alleged failure to apply a policy (assuming the policy is lawful, which is a separate matter), the analysis proceeds as follows:

The first stage asks whether the policy gives rise to a duty to comply. GLP applies a multi-factorial approach by considering the terms of the policies; whether they govern internal administration or if they involve the exercise of public power, deal with the public or affect the rights of an individual; the constitutional role of the court; and whether enforcement creates a real risk that it would deter policy-making in the future.

Duke of Sussex suggests that the mere fact that a policy is ‘inward facing and unpublished’ does not prevent the existence of a duty to comply: at [70]. It is merely one relevant factor at the first stage. This is a notable clarification flowing from GLP, where the inward or internal facing nature of the policies in question there was amongst the main reasons for them not being enforceable in public law: GLP at [59]. Although the Court in Duke of Sussex did not express why the policies in that case were enforceable in public law, notwithstanding their inward facing nature, this is probably because the ToR was capable of being applied to individual cases (relevantly, the Sussex family) and they concerned individual rights of persons to whom they applied.

If there is a duty to comply with the policy, the second stage asks whether the decision-maker has followed the policy. Where a claimant and decision-maker have opposing interpretations of a policy, Mandalia makes clear that the court will decide its true construction. This is a matter of law for which ‘the court is the final arbiter’: R (Hemmati) v Home Secretary [2021] AC 143, [69]. Policies are ‘interpreted objectively in accordance with the language used, read as always in its proper context’: Tesco Stores Ltd v Dundee City Council [2012] UKSC 13, [18]. However, courts should respect the expertise of specialist decision-makers and start ‘at least from the presumption that they will have understood the policy framework correctly’: Suffolk Coastal District Council v Hopkins Homes Ltd [2017] UKSC 37 (Hopkins Homes), [25].

If the decision-maker has not followed the policy, the third stage asks whether there is a good reason for the departure. The intensity of the court’s review depends, as Duke of Sussex tells us, on the kind of policy and the deference that a court ought to pay. Relevant factors include the importance and sensitivity of the subject-matter; whether the policy is inward or public facing; whether it involves a politically sensitive issue with government and democratic accountability; the expertise and institutional capacity of the decision-maker; and the need for the court to avoid usurping the function of the decision-maker. Duke of Sussex encapsulates this spectrum well at [66]: on one end, the court will ‘rarely second guess the expertise of Government agencies’ on ‘the most sensitive issues of national security’ and, on the other end, deference is ‘less obviously required’ for ‘run-of-the-mill decisions on routine cases (perhaps on immigration and benefits issues)’.

However, one aspect of Sir Geoffrey’s reasoning is, with respect, difficult to follow. His Lordship rejected the Home Secretary’s argument that the test for whether a decision-maker’s reason for departure is based on Wednesbury unreasonableness, on the ground that the deference a court should pay exists on a spectrum: at [67]. But Wednesbury review has itself been described as existing on a spectrum, with courts sometimes applying the enhanced rationality standard of ‘anxious scrutiny’ in other contexts where a decision engages fundamental rights: see R (Skelton) v Senior Coroner for West Sussex [2020] EWHC 2813 (Admin), [67]; Browne v Parole Board [2018] EWCA Civ 2024, [52]. The danger of courts refusing the constraints of rationality in deciding whether a reason for departure is ‘good’, is that it potentially encourages an impermissible merits review. I suggest that Sir Geoffrey’s rejection of Wednesbury unreasonableness as a ‘bright line rule’ in [67] (or as necessary in [76]) should not be understood as a wholesale denial of that standard ever being applicable, but instead that it is reserved when the circumstances place it at the lowest end of variable intensity review.

After calibrating or tailoring the intensity of review, the question then becomes: is the reason for non-compliance a good one? Sir Geoffrey seems to have considered that the circumstances in Duke of Sussex warranted the intensity of review towards the lower end of the spectrum when he opined that the reason here was not ‘illogical or inappropriate’: at [73]. ‘Illogicality’ suggests Wednesbury-like review but ‘inappropriateness’ could range from a mere suitability test or perhaps proportionality review. But, if the result of that calibrating and tailoring process came to a higher intensity of scrutiny, a less forgiving test may be adopted, perhaps by asking whether the reasons are cogent, compelling or convincing. Other factors may come into play. Mr Justice Males opined in R (X) v London Borough of Tower Hamlets [2013] EWHC 480 (Admin) at [35] that ‘the greater the departure, the more compelling must that reason be’.

When the public law duty to comply with policies is considered in this three-stage framework, we see that the courts are acutely aware of their own institutional limitations and are acutely sensitive to context and their own constitutional role. As GLP shows, the constitutional role of the court forms part of the first stage’s multi-factorial analysis. As Hopkins Homes notes, there is a presumption at the second stage that expert and experienced decision-makers understand the policy framework. And as Duke of Sussex makes clear, active awareness of the need to defer on issues of national security, high political sensitivity and the decision-maker’s expertise is built into the process of determining the intensity through which a good reason is scrutinised. At all three stages, courts are required to approach review with the institutional expertise and characteristics of the decision-maker firmly in mind.

If commentators are concerned that courts are giving the ‘hard law’ quality of bindingness to the ‘soft law’ of policies, those concerns may be exaggerated. Both GLP and Duke of Sussex show that the duty in question is more nuanced. The courts do not impose a universal duty to comply with every policy. The Court in GLP appreciated that a blanket enforcement rule could, for certain policies like the eight in that case, create ‘real risks’ of harming, rather than helping, public administration. Insistence on compliance is generally limited to those that involve dealing with the public, concern the exercise of public power or are about individual cases or the rights of an individual. Nor do the courts take a knee-jerk reaction once a failure to comply is established. Rather, the judgments of the High Court and Court of Appeal in Duke of Sussex reveal a careful, studied and thorough review of RAVEC’s reasoning process for the departure. Both courts balanced Prince Harry’s entitlement to careful consideration by RAVEC of his security protection against the need for flexibility and cushioning inherent in the notion of ‘soft law’.

Overall, GLP and Duke of Sussex have clarified and developed the courts’ approach to the duty on decision-makers to follow policies. The detailed and rich analysis contained within them reveals more than just a structure for how future cases involving this duty should be approached (which itself makes them deserving of close study). They illuminate the judicial restraint and humility that is embedded in this area of public law.

With grateful thanks to Gabriel Tan for helpful comments on an earlier draft.

Dane Luo is the Farthing Scholar in Administrative Law at Pembroke College, University of Oxford and recently graduated from the Bachelor of Civil Law with the Vinerian Scholarship Proxime Accessit.

(Suggested citation: D. Luo, ‘Security, the Sussexes and Sir Geoffrey’s Judgments on the Duty to Follow Policies’, U.K. Const. L. Blog (7th May 2025) (available at https://ukconstitutionallaw.org/))