MoD says it's too costly to find out if further spreadsheet data breaches occurred

Data protection specialist Jon Baines has raised serious concerns about the Ministry of Defence's (MoD) capacity to track the causes of personal data breaches, particularly those involving inadvertent spreadsheet disclosure. A recent Freedom of Information (FOI) request asking for the number of breaches involving disclosure to the wrong recipient and inadvertent disclosure in a spreadsheet since April 2023 was denied by the MoD, which claimed it would take over 237 hours to locate the data and was therefore "too costly."

Baines points out that inadvertent data disclosure is a common incident and that the lack of a clear, easily searchable record suggests the MoD may not be effectively identifying whether there have been recurrences of the spreadsheet error that caused the 2022 personal data breach, which put thousands of Afghan citizens' lives at risk.

Baines goes on to argue that this inability to track repeat incidents casts doubt on the MoD's assurances to the Information Commissioner's Office (ICO). The ICO previously justified its decision not to formally investigate the 2022 breach by stating that the MoD had briefed them on measures adopted to mitigate future risk. Baines also questioned how the ICO can have confidence that lessons have been learned and that the risk has been effectively mitigated if the MoD cannot easily determine whether further similar incidents have occurred.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.