Company loses challenge against Home Office’s revocation of skilled worker sponsor registration after data breach

About this case:

• Citation:
  [2026] CSOH 13
• Judgment:
  External link
• Court:
  Court of Session Outer House
• Judge:
  Lord Richardson

Pristine Healthcare Group Ltd, which was originally granted a licence in August 2022, argued that the respondent ought not to have suspended its licence without further inquiry into its circumstances following the breach. Alternatively, the respondent had failed to exercise its discretion in considering whether to extend the suspension period rather than proceed to revoke its licence entirely.

The petition was considered by Lord Richardson in the Outer House of the Court of Session. The petitioner was represented by a director of the company, Mr Moses Johnson, after the withdrawal of its original agents, and the respondent by Dewart, advocate.

Not genuine vacancies

On 4 January 2025, the petitioner was informed by Police Scotland that it had suffered a major data breach, which required it to take all of its systems offline. It therefore lost access to the respondent’s Sponsor Management System and all of its HR systems. The respondent provided the petitioner with an email address to use to allow it to update the sponsorship status of its skilled workers following a meeting between Mr Johnson and officers of the Home Office.

On 20 January 2025, officers of the respondent visited the offices of the petitioner to assess its suitability to continue to hold a Sponsor Licence. Its access to the SMS was revoked on 10 February 2025, and the following day, the respondent informed the petitioner had it had been suspended from the register. Revocation followed by notice dated 2 April 2025, which was the subject of challenge in the petition.

In the respondent’s letter of 11 February, it identified a number of issues which led to the suspension of the petitioner’s licence, including that it operated as an employment agency supplying sponsored care workers rather than as a nursing agency, contrary to the respondent’s guidance. The respondent was also not satisfied that the roles carried out by workers were genuine vacancies within the petitioner itself, having found two supposed care workers during the visit of 20 January working in the petitioner’s office and kitchen respectively. Representations were made by the petitioner in response to that letter on 28 February 2025, however the respondent was not satisfied that these addressed the concerns raised.

The starting point of the petitioner’s arguments was that the respondent’s decisions to suspend and then to revoke the petitioner’s licence had to be seen in the context of the exceptional circumstances which had preceded them. Against the background of the data breach and noting serious injuries suffered by its authorising officer which left her without the use of her hands in August 2024, the respondent failed properly to take account of how these impacted on its ability to comply with its duties as a sponsor. The respondent submitted that the petition should be dismissed, as no grounds of Wednesbury unreasonableness had been identified.

Fatal to the argument

In his decision, Lord Richardson began by noting: “Having heard what Mr Johnson had to say about the circumstances he, as managing director of the petitioner, found himself in at the beginning of 2025, it is impossible not to feel sympathy for him. However, having carefully considered the arguments challenging the respondent’s decision to revoke the petitioner’s sponsorship licence put forward on the petitioner’s behalf, I am satisfied that they are without merit.”

He continued: “The petitioner presupposes that there is a power, within the sponsorship scheme, for the respondent to extend the period of suspension in exceptional circumstances. In fact, no such power exists. It is clear from part C9 of the guidance that suspension is intended to provide a short period to enable investigations to be completed by the respondent and for representations to be made by sponsors. The absence of the very power which the respondent is said to have failed to use is fatal to the petitioner’s argument.”

Considering whether the respondent was entitled to conclude that the petitioner did not operate as a nursing agency, Lord Richardson said: “Within the respondent’s letter dated 11 February 2025, the respondent has set out in some detail the basis for her conclusion that the petitioner was, in her view, operating a care employment agency supplying workers to care homes managed by others. In those circumstances, it was incumbent on the petitioner to satisfy the respondent that it was, in fact, complying with its obligations under the sponsorship scheme. Having considered the relevant part of the revocation notice, I do not consider that any valid criticism can be made of the respondent’s approach.”

He concluded: “It is reasonably clear that the respondent was inferring that, insofar as the petitioner intended to reduce the number of certificated roles because these did not align with available work hours, it followed that, at the time of writing, the roles certificated by the petitioner were not genuine. It is clear that the respondent’s position was that, insofar as it had concluded that the petitioner is operating as an agency, it followed that the worker roles being sponsored by the petitioner did not represent genuine roles for the petitioner but were, instead, roles which involved working for third parties.”

The petition was accordingly dismissed.