Question to the Ministry of Defence:

To ask the Secretary of State for Defence, whether his Department cited (a) national security and (b) public interest exemptions under the Data Protection Act 2018 in relation to the Afghan data breach disclosed in 2021.

The Ministry of Defence (MOD) reported several personal data incidents to the Information Commissioner’s Office (ICO) in 2021, under the previous administration, in which individuals seeking Afghan Relocations and Assistance Policy (ARAP) support were identified to each other by the sender using the “to” rather than the “bcc” email field.

When MOD engaged with the ICO in relation to these incidents, the Department highlighted the national security context and the ICO accepted the urgent and pressurised circumstances under which the incidents occurred, although they decided that a monetary penalty notice was still justified. The MOD cooperated extensively with the ICO in addressing these incidents, recognising the severity of what happened and working to improve compliance going forward.