Payout offered to Afghans hit by UK data breaches

Afghan nationals whose personal information was mistakenly exposed by the Ministry of Defence in 2021 will be offered up to £4,000 each in compensation, the government has said.

The data breaches affected 277 people, some of whom had worked for the UK government and were in hiding from insurgent Taliban forces at the time.

Defence Minister Luke Pollard said he could not “undo past mistakes” but promised that the payments would be made “as quickly as reasonably practical”.

The government expects the total cost to be around £1.6m and comes on top of the £350,000 it had to pay after receiving a fine from the data watchdog.

The biggest breach took place in September 2021 when the Afghan Relocations and Assistance Policy (Arap) team was working to evacuate people from Afghanistan following the chaotic withdrawal of western troops.

A mass email was sent to those, such as interpreters, whose work with the UK government meant they could be targeted by the Taliban and therefore made them eligible to be relocated.

Their email addresses were added to the ‘To’ field instead of the ‘blind carbon copy’ (Bcc) section, meaning their names could be seen by all recipients.

The Ministry of Defence later launched an internal investigation that revealed two similar breaches on 7 September and 13 September of that year.

Sean Humber from the Leigh Day law firm which is representing some of those affected said the government’s statement about compensation contained “little information”.

“As far as we are aware, there has been no consultation with those affected or their legal advisors about the scheme – it is not clear the criteria that will be used to identify the proposed payment amount.

“In our client’s case, he and his family spent five very scared months in hiding in Kabul concerned that the Taliban were now aware that he had assisted UK forces and were looking for him.

“He feared for his life and was aware of the Taliban beating and killing others that had assisted UK forces.

“We will need to review critically with our client whether any sum that is now being offered adequately compensates him for distress that he has undoubtedly suffered.”

After investigating the breaches in 2023, information commissioner John Edwards said the error could have led to a “threat to life” and had “let down those to whom our country owes so much”.

The commissioner initially fined the government £1m but that was reduced to £700,000 in recognition of the measures taken by the Ministry of Defence to report the incident, limit its impact and the difficulties of the situation for teams handling the relocation of staff.

It was further reduced to £350,000 as part of a change in approach by the watchdog to public sector fines.

Announcing the compensation payouts in a statement on Friday, Pollard said his department would “drive improvement in the department’s data handling training and practices”.

Earlier this week, the government announced that the Arap scheme was closing to new applicants, having resettled 21,316 Afghans in the UK.

A Home Office paper published on Tuesday said Defence Secretary John Healey believed the scheme had “fulfilled its original purpose”.

It said the scheme could now be shut down “not least so that defence efforts and resources can be focused where they are most needed – on our nation’s security, to combat the acute threats and destabilising behaviour of our adversaries”.