The UK Information Commissioner said his office decided not to open a formal investigation into a Ministry of Defence data breach that exposed personal details of applicants to the Afghan resettlement scheme and which officials say risked the lives of thousands linked to the British Armed Forces.
A National Audit Office a report set out that the breach occurred in February 2022 and that evidence only surfaced publicly in July after a government superinjunction imposed in August 2023 was lifted. The spreadsheet involved 33,345 lines and included names, contact details and information about applicants’ family members, and the overall incident has been estimated to have cost more than £850 million.
The NAO report says the MoD became aware of the breach in August 2023 when details for ten individuals appeared on Facebook. The official who shared the file is reported to have believed they were sending a limited dataset for operational purposes but had inadvertently shared additional information contained in a hidden cell.
Information Commissioner John Edwards told MPs that after meeting MoD officials his office concluded a formal investigation could have impeded the department’s efforts to identify the root cause and to protect affected people. He said the ICO was satisfied with the steps the MoD was taking and that the decision not to pursue a formal probe was recorded formally only after the superinjunction was lifted.
Edwards said the ICO has the capability to handle incidents involving classified information but faced resource limits because it did not have enough vetted staff to work with classified material. He added that the decision to take no further action on a formal investigation was not the same as taking no action to address the breach.
Immediately after the superinjunction was lifted, the ICO wrote to the Cabinet Office saying a joint effort to improve public sector data protection was not working well enough. Edwards told a joint committee with the Department for Science, Innovation and Technology and the Cabinet Office that there would be a plan to raise standards by the end of the year, and the committee chair, Dame Chi Onwurah, said she was disappointed that the Cabinet Office had not sent a minister to the session.