Compensation for Afghan Nationals: An Unforgivable Data Breach by the UK Government
In a significant admission of responsibility, the UK government has announced it will offer compensation of up to £4,000 each to Afghan nationals affected by a 2021 data breach caused by the Ministry of Defence. This breach affected 277 individuals, many of whom assisted the UK government and are currently hiding from the Taliban. Defence Minister Luke Pollard expressed regret for the incident, stating that while past mistakes cannot be undone, efforts would be made to process payments as quickly as possible. The total compensation package is expected to cost about £1.6 million, in addition to the £350,000 fine previously imposed by the UK data watchdog.
The breach primarily occurred in September 2021, when a mass email mistakenly revealed the email addresses of Afghans eligible for relocation under the Afghan Relocations and Assistance Policy (Arap). Such exposure put these individuals at significant risk, as it made their identities visible to others, including the Taliban, who were actively seeking to target those who had helped UK forces.
A subsequent internal investigation highlighted that similar errors had occurred on prior dates in September. Sean Humber, a representative from Leigh Day law firm, remarked that the government’s announcement lacked depth regarding the compensation process, particularly about how the compensation amounts would be determined. He voiced concerns that the offered sums may not sufficiently compensate affected individuals for the emotional distress caused.
Information Commissioner John Edwards criticized the breach, noting it could have led to a “threat to life” for those involved and expressed disappointment in how the situation was handled. The original fine of £1 million for the breach was reduced due to the government’s actions to mitigate its impacts, with further adjustments reflecting changes in the approach to public sector penalties.
Following the compensation announcement, it was also revealed that the Arap scheme would be closing to new applicants, with 21,316 Afghans successfully resettled in the UK. The closure aims to refocus efforts on the national security challenges posed by current geopolitical threats. Overall, this case brings to light serious concerns about data security and the responsibilities of governing bodies in safeguarding sensitive information.