High Court rules 2022 MoD breached UK GDPR

A recently released, partially redacted High Court judgment offers a legal basis for criticism of the actions taken by the Information Commissioner's Office (ICO) in response to a 2022 personal data breach by the Ministry of Defence (MoD). The breach, which only came to light in July of this year after a superinjunction was lifted, exposed the identities of thousands of Afghans and British military officials. 

The incident prompted significant criticism of the ICO's failure to conduct an investigation, a necessary step before any enforcement action could potentially be taken. It is yet to be revealed if the judgment on 19 April had previously been available to the ICO, or whether its findings will result in a change of approach.

The judgment, from a three-judge Divisional Court, dealt with specific cases under the Afghan Relocations and Assistance Policy (ARAP) and was published on 8 August. In its findings (see paragraph 45), the court stated that "although the data leak was accidental, on the materials before us it is strongly arguable that it also involved a breach of the law," before concluding: "It required no hindsight to appreciate that unauthorised disclosure of the dataset might give rise to a risk to life. It should never have been provided to, or disclosed... in unencrypted form. The provision of the dataset... involved a clear breach of article 5(1)(f) (and also article 24(1), 25 and 32) of the" UK General Data Protection Regulation (GDPR). 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.