‘On 17 August 2023 the Ministry of Defence (MoD) put the Information Commissioner’s Office (ICO) on broad notice about the devastating failure of data protection that is now generally known as the Afghan data breach (although sadly there have been many others). This involved the illegal release of some 33,000 lines of gravely sensitive personal spreadsheet data which put almost 100,000 people – up to 25,000 Afghans applying for relocation to the UK as well as their family members, many of whom were also identified in the data – at grave risk of harm and may even have resulted in some of their deaths. However, despite details of this egregious and illegal exposure of data subjects being immediately required by law and subsequently coming into view, the ICO decided not to carry out any investigation and therefore not to take any enforcement action, such as issuing a fine, enforcement notice or even a mere reprimand. Astonishingly, the ICO also made no contemporaneous record whatsoever of the rationale for these critical decisions or even the bare fact that they had been made. Given the exacting supervisory requirements set down in the UK General Data Protection Regulation (GDPR), these subsequent (in)actions expose further serious failings in UK data protection. These failings point to the need for an in-depth independent investigation of UK data protection regulation, which should also explore the serious gap between the UK GDPR’s promises and the ICO’s hyper-discretionary and hyper-selective track-record and approach and what might be done to address this. What follows merely provides a partial indication of some of the particular issues which arise in relation to Afghan spreadsheet data breach itself. It is based on the (still very limited) information which has come into public view so far and builds on a previous blog post on the same subject posted last month.’
Full Story
UK Constitutional Law Association, 3rd September 2025
Source: ukconstitutionallaw.org