ICO insists it was right not to investigate MoD data breach

Information Commissioner: Technology makes it difficult to work with classified information

Data regulator the Information Commissioner’s Office (ICO) has declined to investigate a data breach at the Ministry of Defence that could have put lives at risk.

The data breach, in February 2022, forced the UK government to step in and relocate nearly 7,000 Afghans whose lives were said to be at risk from the Taliban when it returned to power in 2021.

The people at risk had all worked with British armed forces in Afghanistan in positions such as military allies, interpreters and aid workers.

Names, contact details and family information were accidentally included in an email by the Afghan Relocations and Assistance Policy (ARAP) unit.

According to the National Audit Office, the sender believed they were sending limited information to an external party. However, the spreadsheet also contained additional hidden data.

"It was contained in a hidden cell," Information Commission John Edwards said. "The person had a legitimate need to share a limited amount of information. They accidentally shared much more than they intended to."

Speaking to MPs this week, Edwards said his office has decided to abide by an earlier decision not to investigate the matter.

“During those sessions [with MoD officials in 2022] – because of the classification – no notes could be taken, so when my colleague made the decision to take no further action, and he informed me of that, we didn't document it immediately. It was only after the superinjunction was lifted that we recorded a formal decision and put that into the system,” he said.

The superinjunction Edwards refers to is an extraordinary legal tool that not only barred the media from reporting the breach but also from disclosing the existence of the injunction itself. It was secured by the Conservative government in power at the time of the breach.

Edwards went on to put the onus of failing to record the decision not to investigate on the technology, saying that “information systems make it quite difficult to store classified material and to make a meaningful decision.”

With the lifting of the superinjunction, the ICO has now reviewed its original decision and the information available and decided there is no reason to change its mind.

Edwards said the decision was made to avoid hindering the MoD’s own investigation:

"We were given details of how the MoD was responding and we were satisfied with the steps that they were taking. When a breach becomes known to an organisation, there is an immediate need within the organisation to get to the root cause and to rectify the problems, and in this case, to keep safe people that may have been affected, and this was extremely serious. For the ICO to go in and start investigating [an incident, it] can actually get in the way.”

Computing says:

There seems to be a double standard here when it comes to the public sector investigating itself. The desire not to get in the way doesn’t appear to trouble the ICO when it comes to private sector data breaches.

We have contacted the ICO for comment. In response, they sent us this piece from John Edwards in July.

If you’re a current or aspiring cybersecurity leader check out the Computing Security Leaders Summit on March 26th 2026. Packed with content including business continuity planning, bridging the cyber skills gap and cloud resilience, its promises to be full of insight and practical advice to take away. Register here for your free place.