Lawyer for victims of Afghan data breach calls for independent audit of MoD data policies

The first breach was reported on the 20th September and involved an email to more than 250 Afghan interpreters, two days later a further breach was uncovered by the BBC relating to a group email sent to 55 recipients. From discussions his team has had with his clients, Leigh Day data breach lawyer Sean Humber said there also appear to have been yet further recent data breaches. One client refers to receiving an email from Afghan Relocations and Assistance Policy (ARAP) asking him to click a link and provide his and his family’s current details, which he then did. When clicking the link a few days later to update the information, he was able to view somebody else’s personal details and is therefore understandably concerned that the information he provided was similarly shared.

The data breach uncovered by the BBC on 22 September 2021 seems to have occurred in early September 2021 when the ARAP team at the MoD sent a group email to 55 recipients so that each recipient could view the email addresses, as well as in some cases also people's names and associated profile pictures, of all of the other recipients. The recipients, at least one of whom is from the Afghan National Army, were told UK relocation officials had been unable to contact them and they were asked to update their details.

A separate data breach occurred, and was reported by the media, on 20th September 2021 when ARAP sent an email to more than 250 Afghan interpreters who had worked for British forces advising them that ARAP was doing everything possible to get them to safety and not to risk leaving their current location if it was not safe. Unfortunately, the email was also mistakenly sent as a group email so that each recipient could also view the email addresses, as well as people's names and associated profile pictures in some cases, of all of the other recipients.

Sadly, there are reports that the emails, including the personal details of the recipients, have been posted on social media and have been widely viewed in Afghanistan.

Sean Humber, a specialist data breach lawyer at Leigh Day, stated:

“From conversations my team has had with distressed clients trapped in Afghanistan, these data breaches have made an already extremely difficult situation even worse. The Government must recognise that these data breaches are likely to increase the risks posed to those identified in the emails and now do everything they can to urgently relocate them and their families to the UK. In due course, those affected are likely to have substantial claims for compensation against the Government for the unauthorised release of their personal data and the problems that this has caused.

“News of yet another data breach of very sensitive personal information by the Ministry of Defence points to systemic failures in information management. Apologies and announcements of internal investigations are welcome but insufficient. It is now time for the Information Commissioner’s Office (ICO), as the UK’s independent regulator for data protection and information rights law, to carry out a comprehensive data protection audit of the Ministry’s policies and practices.”

Anybody affected by these data breaches who wishes to discuss the matter on a confidential basis, without obligation, should complete the short form set out below or contact Sean Humber on 00 44 20 7650 1200 or by emailing shumber@leighday.co.uk.