The Ministry of Defence (MoD) has been involved in a widely publicised and serious data breach of personal information belonging to Afghan nationals who applied to the Afghan Relocations and Assistance (ARAP) scheme.
What is the ARAP Scheme?
ARAP was launched in April 2021 and intended for Afghan citizens who worked for or with the UK Government in Afghanistan and offered relocation to the UK for those deemed eligible by the MoD. Details about potential applicants are extremely sensitive, and if exposed to the wrong hands, could place individuals’ lives at serious risk.
Lifting of the Super – Injunction
The below is a brief timeline to the events leading up to the lifting of the super-injunction, which revealed the details of the data breach to the public:
- In February 2022, a spreadsheet containing the personal details of 18,714 applicants to ARAP is leaked outside a secure government system by an unnamed British official. The spreadsheet contains the names, contact details and, in some cases, family information of applicants to ARAP.
- The leak is only discovered by the MoD in August 2023 when some of the details are posted on Facebook. The defence secretary, Ben Wallace, applies to the High Court for an initial injunction to prevent the details of the error being made public.
- The High Court issues a restrictive super-injunction in September 2023 precenting reporting of the breach. The government argues that lives were at risk and the Taliban would be alerted if the injunction is not granted.
- The super-injunction is extended in November 2023. Mr Justice Chamberlain, the High Court judge granting the extension, notes that the injunction creates a “scrutiny vacuum”.
- The super-injunction preventing reporting of the leak is further extended in February 2024.
- The injunction is lifted on 15 July 2025, and the details of the leak and relocations are revealed to the public.
- Another injunction is partially lifted on 17 July 2025, which reveals that personal data or special forces and spies was also contained on the leaked database.
The breach has sparked concern on only about compliance with robust data security practices, but also about the immediate safety of those affected. The breach has severe and potentially life-threatening consequences for the Afghan nationals affected and poses a real risk to their security. This is particularly true for those in Afghanistan, who may become a target for reprisals by the Taliban.
Legal basis for claims
This serious breach infringes on Article 2 (Right to life) and Article 8 (Right to privacy) of the European Convention on Human Rights (ECHR) and the Human Rights Act 1998, as well as the common law duty of care. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 require organisations to ensure that personal data is processed securely and protected against unauthorised disclosure.
The legal basis for claiming compensation of a data protection infringement is set out in Article 82 of the UK GDPR, as given effect by section 168 of the Data Protection Act 2018. Under these provisions, any person who has suffered material or non-material damage has the right to compensation. ‘Damage’ in this context includes distress.
People who have been affected may have been contacted by the MoD. The Government have also created a website for potential victims for check if they have been affected by the leak. Individuals who first applied to ARAP after 7 January 2022 have not been affected as their personal data would not have been contained in the leaked spreadsheet.
Any affected person has 6 years from the date of the breach to bring a claim, and the period runs from the date of lifting the super-injunction on 15 July 2025. However, Taylor Hampton Solicitors encourages anyone who may have been affected to seek legal advice as soon as possible.
Compensation
Taylor Hampton Solicitors is highly experienced in representing victims of unlawful activity, including acting for a large number of individuals in a group litigation structure. Our firm has expertise in acting in defamation, privacy, and immigration matters. Taylor Hampton Solicitors also pioneered claims for phone hacking, which led to the closure of the News of the World and the establishment of the Leveson Inquiry. We are committed to acting for individuals and victims of wrongdoing and are well placed to hold powerful organisations or public authorities to account.
Taylor Hampton Solicitors is currently investigating claims. If you have been affected by any of the issues and would like to get in touch confidentially, please contact us by sending an email to Lia Perin at [email protected].
Disclaimer: This article provides general guidance only and does not constitute legal advice. Civil procedure rules and case law can change. Always seek professional legal advice tailored to your specific situation before acting.