Lawful on paper, risky in practice?

The High Court has rejected a legal challenge to the Met’s policy of automatically deleting WhatsApp messages after 90 days.

For the force, the judgment in R (BB) v Commissioner of Police of the Metropolis [2026] EWHC 1986 (Admin) is undoubtedly welcome. The Met successfully defended all four grounds of challenge, including allegations that its guidance breached disclosure obligations, frustrated Parliament’s intentions, was irrational and infringed the claimant’s right to a fair trial.

However, while Mr Justice McKendrick upheld the policy itself, his reasoning repeatedly returns to a different issue: whether officers can be relied upon to identify, preserve and disclose relevant material before it disappears. That question remains very much alive.

The claimant, who faces trial on charges including coercive and controlling behaviour, argued that the Met’s guidance requiring officers to enable WhatsApp’s disappearing messages function effectively sanctioned the destruction of material that might later prove relevant to criminal proceedings. The court disagreed.

Applying the Supreme Court’s approach to challenges against public authority policies, the judge found that the Met’s guidance neither misstated officers’ obligations under the Criminal Procedure and Investigations Act (CPIA) nor purported to provide a complete explanation of them.

Instead, the policy tells officers not to use WhatsApp for evidential discussions and requires them to export any relevant conversations before they expire. Whether officers consistently follow those instructions is a separate issue. That distinction between the legality of a policy and the quality of its implementation runs throughout the judgment.

Risky business

The importance of that distinction becomes apparent through the evidence of one officer involved in the claimant’s case.

DC Archer had exported one WhatsApp conversation with the complainant before messages disappeared. However, during the proceedings she later discovered two additional exports that had been overlooked because they had been saved under identical file names. By that point, she was unable to say what had been contained in messages that had already expired under the 90-day policy.

The judge stopped well short of describing this as evidence of systemic failure.

Nevertheless, the episode illustrates the practical challenge at the heart of the policy. Its success depends on officers consistently recognising relevant material, exporting it before deletion, storing it correctly and ensuring it can later be found. Where any part of that process fails, potentially relevant evidence may be lost.

The claimant also relied on a substantial body of external criticism, including HMICFRS’s Shining a Light on Betrayal report, the IOPC’s review of instant messaging in policing and concerns raised by the Information Commissioner’s Office.

Despite this, the court concluded that the Met had acted rationally.

Mr Justice McKendrick accepted that a 90-day deletion period represented a defensible balance between privacy, operational practicality and evidential requirements. He also accepted that the force had engaged with the ICO and revised its Data Protection Impact Assessment in response to those discussions. However, the judgment is notable for its own expressions of caution.

The judge acknowledged his “reservations about deleting potentially relevant material” in cases involving an individual’s liberty. He also observed that the guidance’s statement that chats “can” be exported would have been stronger had it said they “should” be exported.

Those are not the observations of a court giving unconditional approval.

The claimant’s argument that the policy breached his right to a fair trial under Article 6 of the European Convention on Human Rights also failed. But only for procedural reasons.

The court held that questions about whether deleted messages were actually relevant to the defence are matters for the Crown Court conducting the criminal trial, not for judicial review proceedings examining the legality of the policy itself.

That leaves open the possibility that future criminal courts may still have to consider the consequences of missing WhatsApp evidence in individual cases.

Lessons for policing

The judgment will undoubtedly be welcomed by forces operating similar instant messaging policies. But it should not be read as confirming that those policies are beyond criticism.

Instead, it reinforces a narrower proposition: a policy can be lawful while still creating significant operational risks if it is not implemented consistently.

For forces reviewing their own guidance, the practical lessons are clear. Export requirements should be framed as mandatory rather than discretionary. Supervisory oversight should ensure relevant material is actually being preserved. Monitoring systems should work in practice rather than simply existing on paper. Most importantly, officers need confidence in identifying what may later become disclosable material.