The British government relocated one Afghan family to the UK after they sought to use data protection laws to uncover details of the colossal data breach that officials kept secret for two years.
A man referred to in court papers as “MK” was among 1,800 Afghans who had fled to Pakistan and received a WhatsApp alert from UK officials in August 2023 warning their data may have been compromised.
The message gave few details about the nature or scale of the breach. After MK demanded more information via a UK law firm, UK officials agreed to relocate him and his family, court papers showed.
Most of the 25,000 Afghans whose details were in the leaked database were not notified until this month, when ministers closed all of the UK’s Afghanistan-related relocation schemes.
The database contained sensitive details about Afghans who had co-operated with the UK government before the Taliban retook power, as well as the names of some MI6 operatives and British special forces, according to people familiar with it.
MK’s experience illustrates the disparity in the way Afghan victims of the leak were treated: some were able to take precautions or secure relocation to the UK, while many others were kept in the dark.
The data loss had sparked fears that the victims of the breach could face reprisals including murder if the Taliban obtained it. The government obtained an unprecedented superinjunction in September 2023 to ban the media from revealing the leak or even the existence of the gag order.
A senior Ministry of Defence official told the High Court last autumn that MK used a provision under data protection laws to formally demand information about whether his personal details had been compromised.
The “subject access request” was submitted in February 2024 on his behalf by law firm Leigh Day. It requested confirmation of what information had been lost, what risks to him had been identified and what steps had been taken to mitigate those risks.
Sean Humber, solicitor at Leigh Day, said the UK government had initially signalled its approval for MK’s application to resettle in Britain and as a result he had travelled to Pakistan with his wife and child. However, the approval was revoked and MK threatened legal action.
Natalie Moore, the senior MoD official, said in her witness statement that the MoD did not respond to MK’s subject access request and his “claim was settled on the basis that he was offered relocation and MK withdrew his application for judicial review”.
MK had been told by officials that the permission to come to the UK was because he had been given a “legitimate expectation” of resettlement, according to Humber.
Six months later in August 2024, MK was still stuck in Pakistan. He threatened legal action again in a letter, alleging the British defence secretary had failed to provide adequate protection for him and his family while in Pakistan, according to Moore’s witness statement. MK also repeated the request for information about the data breach.
“We did not respond to that letter, or further emails asking for a response received on 16 August, 19 August and 20 August 2024. However, steps were taken to ensure that the claimant and his family were relocated to the UK on 23 August,” Moore said.
The MoD has sought to present the resettlement of Afghans that has taken place under the secret immigration route, which was set up in the wake of the data breach, as having been based primarily on threat — with only the Afghans at highest risk offered relocation.
Defence secretary John Healey told MPs on Tuesday the secret scheme was “designed for people in the compromised dataset who were not eligible for Arap but who were nevertheless judged to be at the highest risk of reprisals by the Taliban”.
Separately, the FT reported earlier this week, citing a person familiar with the matter, that another Afghan, who obtained the database, used their possession of it as leverage to press the government to relocate themselves and 14 family members to the UK.
Tan Dhesi, Labour chair of the House of Commons defence select committee, said: “This whole situation is very messy and that’s why it is imperative that we have transparency and accountability to ascertain exactly what has happened.”
His committee is launching an inquiry to find out “who knew what and who took decisions, based on what advice”, including over relocations.
“The superinjunction has robbed our parliament and our media of the key tenets of our democracy. We need to get to the bottom of exactly what has happened,” he added.
In total 6,900 Afghans are being resettled in Britain through a secret immigration route set up in response to the leak, called the Afghan Response Route, which Healey has said will cost about £850mn.
He announced on Tuesday that it was closing to new applicants, partly on cost grounds.
Another 1,000 Afghans are being resettled through the public Afghan Relocations and Assistance Policy (Arap) on the basis that the leak made them newly eligible for that route, according to officials.
A total of 17,000 Afghans coming to Britain through Arap were “affected” by the breach but most would have been eligible anyway, the MoD has said. Most of that number is made up of family members of principal applicants.
An MoD official said of MK’s case: “There was no direct negotiation with him or any quid pro quo. Other people have appealed through normal routes, instructed lawyers on their behalf and had their cases reassessed. Some have then been approved and some have been rejected.”
The MoD said: “All Arap cases are assessed in line with the public eligibility criteria. Where legal claims on eligibility are brought, these are assessed on the individual facts of the case and any decisions made in line with relevant policy.”
