ICO investigation into Afghan data leak hampered by MoD

An article in The Telegraph (£) reports on the limitations imposed on the Information Commissioner's Office (ICO) while investigating the 2022 personal data breach at the Ministry of Defence (MoD), described in a newspaper as "the most expensive email in history." 

According to an internal memo released under freedom of information rules in August, the ICO was banned from making written notes about the highly classified incident by defence officials.

The memo revealed that the MoD only allowed three of the ICO's 770 staff to be aware of the leak. These three staff members were barred from recording information on their own IT systems, making written notes of meetings, or taking away copies of evidence.

The ICO's senior managers ultimately decided they were "unable to take regulatory action at this time," opting instead to review and oversee the MoD's internal investigation. An MoD source insisted this did not prevent the ICO from doing its job, and Information Commissioner John Edwards said their approach was consistent with how they handle many other similar breach notifications.

However, data protection specialist Jon Baines of Mishcon de Reya expressed confusion at the ICO's decision not to conduct a proper investigation. Baines said that he was "baffled by the ICO's failure to conduct a proper investigation." He argued that the ICO's actions compromise its independence and that the failure to take formal action means the most catastrophic data breach in UK history resulted in no action by the regulator. Baines added that "the ICO appears to want to justify not imposing a fine on the MoD, but in doing so, seem to have forgotten that they have other powers – such as the ability to issue reprimands, or to lay reports before Parliament."

£ - This article requires a subscription.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.