The UK government has announced a financial compensation scheme for Afghan nationals whose personal data was inadvertently disclosed by the Ministry of Defence (MoD) in a serious breach in 2021. Each affected individual will be eligible to receive up to £4,000 as a form of restitution. The disclosing event has drawn significant public attention, highlighting the implications and potential hazards faced by individuals who supported UK efforts in Afghanistan.
This data breach has impacted a total of 277 Afghan nationals, many of whom had worked closely with UK forces and were subsequently in hiding from the Taliban. Defense Minister Luke Pollard acknowledged the severity of the situation, stating that while he could not “undo past mistakes,” his department would expedite the compensation process “as quickly as reasonably practical.” The total cost of the compensation scheme is anticipated to reach approximately £1.6 million, representing an added financial burden on top of the £350,000 fine imposed by the data protection regulator after the breach was uncovered.
The most consequential data breach occurred in September 2021, during a critical period when the Afghan Relocations and Assistance Policy (Arap) team was engaged in relocating Afghans following the chaotic withdrawal of Western military forces. A significant blunder took place when an email was sent to interpreters and others eligible for relocation. Unfortunately, their email addresses were mistakenly placed in the ‘To’ field rather than in the ‘blind carbon copy’ (Bcc) section, resulting in a situation where their identities were exposed to all recipients. In the aftermath, the MoD launched an investigation which revealed additional breaches dated from September 7 to 13 of the same year.
Legal representatives for the affected individuals have expressed concern regarding the government’s approach to compensation. Sean Humber from the Leigh Day law firm remarked that the government’s announcement offered “little information” on the compensation process, further highlighting a lack of clarity on the criteria that will be applied to determine the payment amounts. One client, who is represented by Humber, described the distress experienced by himself and his family during five tense months of hiding in Kabul, fearing that the Taliban now possessed their personal information and posed a direct threat to their safety.
In an effort to address the breach’s implications, Information Commissioner John Edwards characterized the error as one that could have potentially led to a “threat to life” for the affected individuals. The initial fine levied against the government for the breach was set at £1 million but was subsequently reduced in recognition of the efforts made by the MoD to limit the impact of the breach and for managing the challenging circumstances surrounding the relocation mission. Ultimately, the fine was further reduced to £350,000 following a change in the approach adopted by the data watchdog regarding public sector penalties.
In announcing the compensation payouts, Minister Pollard committed to enhancing the MoD’s practices related to data handling and staff training to prevent similar occurrences in the future. Additionally, the government recently declared that the Arap scheme will cease accepting new applications, having successfully resettled a total of 21,316 Afghans in the UK. A Home Office report also indicated that Defence Secretary John Healey feels the program has fulfilled its original objectives, thereby opening the door for a reallocation of defense resources to address pressing security threats posed by adversaries both nationally and globally.
In summary, while compensation aims to address the repercussions of significant data breaches affecting vulnerable individuals, the ongoing dialogue surrounding transparency and accountability remains critical to restoring the trust lost among Afghan nationals who relied on UK government support in their time of need. The resolution of this matter not only impacts the affected individuals but also serves as a reminder of the importance of proper data handling in sensitive situations that could affect lives.
