LONDON: Afghans whose personal information was exposed in a UK Ministry of Defence data breach have been told they can claim up to £4,000 ($5,400) in compensation.
The breach, which happened in September 2021, saw the email addresses of 265 Afghans who had worked with British forces mistakenly shared in a group email sent by the ministry’s Afghan Relocation and Assistance Policy team.
The message, intended to provide updates on evacuation plans, used the “To” field instead of the blind carbon copy function, which revealed names, email addresses and in some cases thumbnail profile images.
On Friday, Armed Forces Minister Lord Coaker confirmed the compensation scheme in a written statement to Parliament, saying the ministry was taking a “proactive” approach to what he described as a historical data-handling incident, The Times reported on Saturday.
“I can confirm to members the Ministry of Defence will be directly contacting those individuals who were affected by the data incident,” he said. “Once a response is received and the affected individual’s identity confirmed, a single ex gratia payment of up to £4,000 per individual will be made.”
The ministry expects the total cost to be about £1.6 million.
“Every effort will be made to ensure payments are made as quickly as reasonably practical,” Coaker said.
“I cannot undo past mistakes but I wish to assure members that in my role as minister for the armed forces I intend to drive improvement in the department’s data handling training and practices.”
The ministry’s record on such issues “must improve and I am determined to ensure it does,” he said.
The breach was condemned at the time by then shadow defense secretary John Healey, who said: “We told these Afghan interpreters we would keep them safe, instead this breach has needlessly put lives at risk.”
In December 2023, the Information Commissioner’s Office fined the ministry £350,000 over the incident.
UK Information Commissioner John Edwards described it as “a particularly egregious breach of the obligation of security owed to these people, thus warranting the financial penalty my office imposes today.”
“This deeply regrettable data breach let down those to whom our country owes so much,” he said.
Following the incident, the ministry contacted those affected and asked them to delete the original email, change their contact details and inform the ARAP team using a secure form. Concerns were raised at the time that the information could have fallen into the hands of the Taliban.
