July 18, 2025 • 14 mins
The dramatic revelation of a massive and expensive data breach has blindsided Westminster. It's the first time that a superinjunction, which stops media reporting, has been used by the government. We talk to Sean Humber, from law firm Leigh Day, who specialises in privacy breach compensation claims and is organising a class action in the case. We ask if the government is getting worse at handling data, and how much it might eventually cost. Hosted by Caroline Hepker and Yuan Potts.
See omnystudio.com/listener for privacy information.
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
Bloomberg Audio Studios, podcasts, radio news.
Speaker 2 (00:11):
Lets just speak of this serious theater incident should never
have happened. It may have occurred three years ago under
the previous government, but to all those whose information was compromised,
I offer a sincere apology today on behalf of the
British government.
Speaker 1 (00:27):
So an apology from the Defense Secretary John Healey, after
it was revealed a data leak had compromised the safety
of thousands of Afghans who worked with the British government.
It's been kept secret for three years while a superinjunction.
The revelation has sent shockwaves across Westminster. Hello, you're listening
to Blueberg UK Politics. I'm Caroline Hepka and I'm.
Speaker 3 (00:49):
New and Potts. The dramatic revelation of a massive and
expensive data breach this week has blindsided Westminster. It's the
first time that a superinjunction, which stops the media reporting
a store, has been used to protect the government from
press coverage. The government says that it was to allow
them time to fly affected Afghans out of the country
and to protect their safety, but it's raised questions over
(01:12):
the scheme's enormous cost and the political timing, given that
this happened under the previous administration and wasn't imported on
until after the election.
Speaker 1 (01:20):
Well earlier. I spoke to the Labour MP Lloyd Hatton,
MP for South of Dorset. He sits also on the
Parliamentary Committee, the Public Accounts Committee, and he says that
the scrutiny from his fellow MPs is only just beginning.
Speaker 4 (01:37):
When this this scandal, this breach in it first materialized
under the previous government, I think, you know, there was
some probably some real big mistakes made, particularly around sound
use of taxpayers money. I think the ministers at the
time in that previous government have some serious questions to answer,
and I imagine those ministers and other officials, civil servants
(01:59):
and the rest of it will come before committees to
answer questions and to rightly be held to account.
Speaker 1 (02:06):
So that was the Labour MP Lloyd Hatten. Some of
those former ministers have been out speaking to the media
defending the wide ranging superinjunction and why it was put
into place. But all of this puts troubling issues for
Labor back on the agenda. How well is it coping
with high levels of migration, for one, and is the
(02:27):
machinery of government functioning as it should well.
Speaker 3 (02:31):
On the show today, Sean Humber, partner at law firm
Lee Day. Sean is a human rights lawyer and privacy
breach compensation claims specialist. Sean, in your experience of data breaches,
just give us a sense of the scale of this one.
Speaker 5 (02:45):
No, this really was patastrophic data breach. I think because
the two reasons really that combine. First of all, because
of the sensitivity of the information, and sensitive in this
case was that it identify those named on it having
helped the UK Forces prieviously and then were at risk
from the Taliban following September twenty twenty one. So that's
(03:08):
the first thing, is the combination sensitive and information. The
second things the numbers affected. This over eighteen thousand people
affected by the data breach, so it's the common If
you put those two together, I'd say this is really
is a very serious data breach.
Speaker 1 (03:23):
There were also details of more than one hundred Britons,
including those working as spies and in the Special Forces,
that were part of that massive data breach. Although I
think it's worth understanding that that more than eighteen thousand
people who had applied for the Afghan Relocations and Assistance
Policy program. That the scheme, which was called ARAB it
(03:44):
was in the process of being worked on to assess
whether those people were going to be eligible for relocation
or help by the UK government. So that was what
was being worked on at the time. Your firm is
now investigating a group claim for compensation in this case,
(04:06):
So tell us about the process at the moment and
what you're thinking about now.
Speaker 5 (04:11):
Yes, I think looking at the kind of legal issues,
we think it's a strong claim because I think as
the government has admitted this was a serious data breach,
they accept that the breach was unacceptable, and in finis
they've issued an apology that the law is very clear
that the organizations you know our organization, you know your organization,
(04:32):
but the government as well have an obligation to take
steps to keep sensitive information safe and they didn't here.
And I think that the point was, yes, it was
a mistake and no one did it deliberately, but you
need to have policies and procedures in place that stop that.
We all have bad days, but you need you need
to have systems in place to stop something as bad
(04:55):
as this happening. And they didn't so I think it's
pretty clear that they breached the law on this as
a breach of the UK General GDPR Data Protection Act,
and it's also in legal terms of something called the
misuse of private information. So I think it's pretty clear
that legally the claim is strong that the government didn't
take the action needed to keep the information safe. Now,
(05:16):
as a result of ours, people are able who've been
affected by it, are able to make a claim for
the fact that there's been a loss of control over
their sensitive personal information and then the distress and there's
been caused by that.
Speaker 3 (05:31):
I'm interested in the money we're talking about in this case.
Clearly this is turning out to be incredibly expensive for
the government. I don't think we quite yet know all
the details of that because this is so fresh, but
it's running into the billions, and it's likely with this
case they're going to be on the hook for even
more money. How much do you think these people are
likely to get and how much could the bill end
(05:53):
up costing the taxpayer.
Speaker 5 (05:56):
I think it's difficult to generalize one of them need
to look on a case by case basis of the
effect of the disclosure. Clearly, the disclosure itself is common
to everyone, but the effects of that disclosure is different.
So for instance, it's likely that somebody who remains in
Afghanistan and as suddenly found out the first time on
Tuesday that their personal data had been been disclosed, they
(06:21):
probably have a greater claim than somebody that's now in
the UK. So I think it's important to say that
compensation claims for data breach cases have been relatively modesty
is Obviously it's difficult to look at something it's analogous
to this, but it's usually in the thousands. But again
(06:42):
I think it's important to say we'll need to look
on a case by case basis about what the effect
of that disclosure has been on them.
Speaker 1 (06:49):
Okay, I mean worth putting a couple of points. For example,
that the Taliban government in Afghanistan says that it has
not and has denied monitoring citizens or using it for
reprisals within Afghanistan after the revelation of this data leak,
at least according to local reporting, And also when it
(07:10):
comes to the person actually who released the email in
error this data leak and how it happened, Apparently, again
according to reporting in the UK, they were moved to
a new role they weren't sacked. In terms of the process,
then if you say that it's going to be a
case by case basis, I mean that is going to
(07:31):
be an enormous amount of work. If that is truly
going to go through each individual case rather than rather
than a mass claim.
Speaker 5 (07:40):
Sorry, I probably haven't been this close. I could. It
will be a group claim because people are affected in
the same way. But within that group claim there will
be you know, we'll obviously identify the individuals have been affected,
and this process allows for the payment of different amounts
of compensation aarding to how people have been affected, and
(08:03):
so one will be able to take instructions and details
from each of the people about what they considered to
be the effects of the disclosure on them. So I
mean group claims are relatively common in the UK, and
they're done in a streamlined way where there will be
(08:23):
some common features, some individual.
Speaker 3 (08:25):
Features I mentioned. Obviously you think this is a winnable case,
otherwise you wouldn't be taking on. But the mod say
that they've taken appropriate action in line with the level
of risk these individuals faced, and they say that any
claims that they do get, we will fight them hard.
Speaker 5 (08:42):
Well, I'm not. I think I think it's probably not
uncommon in litigation for people to say things like that,
and and in the end some kind of settlements or
are usually reached all the matter of thenicycordance for the
judge to decide. I think the points that I probably
need to dress is that legally, this seems to be
a strong claim because that the breach was unacceptable, and
(09:06):
it seems to me that there's good evidence that people
have suffered adverse consequences because of that. And you know,
if you're still in Afghanistan, for example, there seems to
be credible evidence from all sorts of media outlets and
reports over the earths and reports fermendios that there is
a problem if your associated having assisted the previous regime.
(09:29):
There are still killings, there are still human rights abuses,
and so the leak of this information does exacerbate their vulnerability,
it seems to us, and there's good credible evidence for that.
Speaker 1 (09:43):
You say that you're also representing claimants who are still
in Afghanistan. How difficult is that given that backdrop of
representing them and thinking about this case with people based
either in the UK or in Afghanistan.
Speaker 5 (09:57):
Yes, obviously those who remain in Afghanist and aren't particularly vulnerable,
and we were acting for them in this case, but
frankly we've also acted for others in previous cases. Which
is another point to make that this is just the latest,
or albit the most serious of a long line of
data breaches by the mt of of of those Afghans
(10:18):
that have assisted them. So there seems to be in
a very cavalier attitude towards towards those those people some
confidential information. But yes, there are difficulties in relation to
communications with those and in recent days we've obviously been
in communication with a number that remain in Afghanistan. Frankly
(10:41):
are very very worried.
Speaker 3 (10:43):
I've interested in the environment around these group legal actions.
How has that changed over the years, other more of
them these days?
Speaker 5 (10:51):
Yes, I think it's fair to say that the legal
profession in recent years has has has there have been
more more group claims in operation tovariety of different matters.
But in a way, if you think about it, it's
the way that one can bring these claims most economically.
What you don't want is thousands of thousands of separate
(11:12):
claims brought in a range of different courts presumably that
are essentially looking at the same matters. So what the
courts have decided to do is that they're the ones
that step up a procedure for this where you do
bring these claims as groups. But within that there are
obviously issues that are specific to the individuals, so their
(11:33):
group claims. But there is there is there is, you know,
also an analysis of individual situations in.
Speaker 1 (11:41):
Terms of the you talk about a pattern of behavior
by the mod that it effectively goes to the kind
of machinery of government that the cavalier attitude that you mention,
you clearly perceive a significant problem with adhering to the
gd PR rules. Is that still the case under this
(12:03):
labor government?
Speaker 3 (12:04):
Be fair.
Speaker 5 (12:05):
I don't have any kind of information in terms of
very recent situation, but I think just to give an example,
we're acting for other Afghans who affected by a serious
data breach and because in September twenty twenty one where
their names are put into of a group email, but
not as going to blind copy, but just so everyone
could see everyone else's names. And so that was that
(12:28):
was a serious breach and there were fines by the
Information Commission's Office, the regulator for that. Now what happened
after September twenty one is the Defense actually came to
the House, made a statement probably not that similar from
the statement made early this week, but then said, look,
we've now got our house in order, we've changed our policies,
(12:51):
we've changed our practice. This can't happen again. And then
lo and behold you now have the announcements are earlier
this week where there was this serious desh preach the
curve six months afterwards. Yeah. So I think the problem
is is that it is very difficult to know the
Mistery of Defense. I always keep saying it's learnt the lessons,
(13:13):
but these problems still keep on occurring.
Speaker 3 (13:17):
Suan, really good to get your thoughts on that. Seawan
Humber previously breached compensation specialist at law firm Lee Day,
clearly a really you know, chaotic state of affairs that
the Ministry of Defense are really really big mess up,
which has not only put a lot of people's lives
at risk but cost a huge amount of money.
Speaker 1 (13:35):
Well, listen former ministers Grant Shaps and Ben Wallace who
initially applied for the superinjunction and then the kind of
the follow up wider ranging superinjunction. Have both defended their
moves here that there was no apology for applying for
the initial injunction. The government has defended the actions that
(13:57):
they've taken to try to sort of mitigate the dangers
to the Afghan individuals who were named. So, look, I
think we're going to have to see what the government
does about this in terms of how much the projected
cost is of this relocation program at the moment eight
hundred and fifty million pounds. Let's see where the court
cases end up.
Speaker 3 (14:19):
Yeah, I'm the first ever used by the government of
a superinjunction, which course very significant in itself. Well, that's
it from us for today. If you like the program,
don't forget to subscribe and give it five stars so
other people can find it on Apple Podcasts, at Spotify,
or wherever you lis.
Speaker 1 (14:33):
This episode was produced by Harry Blackheart Audio Engineers Andrew Gavin.
I'm Caroline Hope Yet.
Speaker 3 (14:38):
And I'm your Impots. We're back with more next Friday.
Is Boomberg
Bloomberg Audio Studios, podcasts, radio news.
Speaker 2 (00:11):
Lets just speak of this serious theater incident should never
have happened. It may have occurred three years ago under
the previous government, but to all those whose information was compromised,
I offer a sincere apology today on behalf of the
British government.
Speaker 1 (00:27):
So an apology from the Defense Secretary John Healey, after
it was revealed a data leak had compromised the safety
of thousands of Afghans who worked with the British government.
It's been kept secret for three years while a superinjunction.
The revelation has sent shockwaves across Westminster. Hello, you're listening
to Blueberg UK Politics. I'm Caroline Hepka and I'm.
Speaker 3 (00:49):
New and Potts. The dramatic revelation of a massive and
expensive data breach this week has blindsided Westminster. It's the
first time that a superinjunction, which stops the media reporting
a store, has been used to protect the government from
press coverage. The government says that it was to allow
them time to fly affected Afghans out of the country
and to protect their safety, but it's raised questions over
(01:12):
the scheme's enormous cost and the political timing, given that
this happened under the previous administration and wasn't imported on
until after the election.
Speaker 1 (01:20):
Well earlier. I spoke to the Labour MP Lloyd Hatton,
MP for South of Dorset. He sits also on the
Parliamentary Committee, the Public Accounts Committee, and he says that
the scrutiny from his fellow MPs is only just beginning.
Speaker 4 (01:37):
When this this scandal, this breach in it first materialized
under the previous government, I think, you know, there was
some probably some real big mistakes made, particularly around sound
use of taxpayers money. I think the ministers at the
time in that previous government have some serious questions to answer,
and I imagine those ministers and other officials, civil servants
(01:59):
and the rest of it will come before committees to
answer questions and to rightly be held to account.
Speaker 1 (02:06):
So that was the Labour MP Lloyd Hatten. Some of
those former ministers have been out speaking to the media
defending the wide ranging superinjunction and why it was put
into place. But all of this puts troubling issues for
Labor back on the agenda. How well is it coping
with high levels of migration, for one, and is the
(02:27):
machinery of government functioning as it should well.
Speaker 3 (02:31):
On the show today, Sean Humber, partner at law firm
Lee Day. Sean is a human rights lawyer and privacy
breach compensation claims specialist. Sean, in your experience of data breaches,
just give us a sense of the scale of this one.
Speaker 5 (02:45):
No, this really was patastrophic data breach. I think because
the two reasons really that combine. First of all, because
of the sensitivity of the information, and sensitive in this
case was that it identify those named on it having
helped the UK Forces prieviously and then were at risk
from the Taliban following September twenty twenty one. So that's
(03:08):
the first thing, is the combination sensitive and information. The
second things the numbers affected. This over eighteen thousand people
affected by the data breach, so it's the common If
you put those two together, I'd say this is really
is a very serious data breach.
Speaker 1 (03:23):
There were also details of more than one hundred Britons,
including those working as spies and in the Special Forces,
that were part of that massive data breach. Although I
think it's worth understanding that that more than eighteen thousand
people who had applied for the Afghan Relocations and Assistance
Policy program. That the scheme, which was called ARAB it
(03:44):
was in the process of being worked on to assess
whether those people were going to be eligible for relocation
or help by the UK government. So that was what
was being worked on at the time. Your firm is
now investigating a group claim for compensation in this case,
(04:06):
So tell us about the process at the moment and
what you're thinking about now.
Speaker 5 (04:11):
Yes, I think looking at the kind of legal issues,
we think it's a strong claim because I think as
the government has admitted this was a serious data breach,
they accept that the breach was unacceptable, and in finis
they've issued an apology that the law is very clear
that the organizations you know our organization, you know your organization,
(04:32):
but the government as well have an obligation to take
steps to keep sensitive information safe and they didn't here.
And I think that the point was, yes, it was
a mistake and no one did it deliberately, but you
need to have policies and procedures in place that stop that.
We all have bad days, but you need you need
to have systems in place to stop something as bad
(04:55):
as this happening. And they didn't so I think it's
pretty clear that they breached the law on this as
a breach of the UK General GDPR Data Protection Act,
and it's also in legal terms of something called the
misuse of private information. So I think it's pretty clear
that legally the claim is strong that the government didn't
take the action needed to keep the information safe. Now,
(05:16):
as a result of ours, people are able who've been
affected by it, are able to make a claim for
the fact that there's been a loss of control over
their sensitive personal information and then the distress and there's
been caused by that.
Speaker 3 (05:31):
I'm interested in the money we're talking about in this case.
Clearly this is turning out to be incredibly expensive for
the government. I don't think we quite yet know all
the details of that because this is so fresh, but
it's running into the billions, and it's likely with this
case they're going to be on the hook for even
more money. How much do you think these people are
likely to get and how much could the bill end
(05:53):
up costing the taxpayer.
Speaker 5 (05:56):
I think it's difficult to generalize one of them need
to look on a case by case basis of the
effect of the disclosure. Clearly, the disclosure itself is common
to everyone, but the effects of that disclosure is different.
So for instance, it's likely that somebody who remains in
Afghanistan and as suddenly found out the first time on
Tuesday that their personal data had been been disclosed, they
(06:21):
probably have a greater claim than somebody that's now in
the UK. So I think it's important to say that
compensation claims for data breach cases have been relatively modesty
is Obviously it's difficult to look at something it's analogous
to this, but it's usually in the thousands. But again
(06:42):
I think it's important to say we'll need to look
on a case by case basis about what the effect
of that disclosure has been on them.
Speaker 1 (06:49):
Okay, I mean worth putting a couple of points. For example,
that the Taliban government in Afghanistan says that it has
not and has denied monitoring citizens or using it for
reprisals within Afghanistan after the revelation of this data leak,
at least according to local reporting, And also when it
(07:10):
comes to the person actually who released the email in
error this data leak and how it happened, Apparently, again
according to reporting in the UK, they were moved to
a new role they weren't sacked. In terms of the process,
then if you say that it's going to be a
case by case basis, I mean that is going to
(07:31):
be an enormous amount of work. If that is truly
going to go through each individual case rather than rather
than a mass claim.
Speaker 5 (07:40):
Sorry, I probably haven't been this close. I could. It
will be a group claim because people are affected in
the same way. But within that group claim there will
be you know, we'll obviously identify the individuals have been affected,
and this process allows for the payment of different amounts
of compensation aarding to how people have been affected, and
(08:03):
so one will be able to take instructions and details
from each of the people about what they considered to
be the effects of the disclosure on them. So I
mean group claims are relatively common in the UK, and
they're done in a streamlined way where there will be
(08:23):
some common features, some individual.
Speaker 3 (08:25):
Features I mentioned. Obviously you think this is a winnable case,
otherwise you wouldn't be taking on. But the mod say
that they've taken appropriate action in line with the level
of risk these individuals faced, and they say that any
claims that they do get, we will fight them hard.
Speaker 5 (08:42):
Well, I'm not. I think I think it's probably not
uncommon in litigation for people to say things like that,
and and in the end some kind of settlements or
are usually reached all the matter of thenicycordance for the
judge to decide. I think the points that I probably
need to dress is that legally, this seems to be
a strong claim because that the breach was unacceptable, and
(09:06):
it seems to me that there's good evidence that people
have suffered adverse consequences because of that. And you know,
if you're still in Afghanistan, for example, there seems to
be credible evidence from all sorts of media outlets and
reports over the earths and reports fermendios that there is
a problem if your associated having assisted the previous regime.
(09:29):
There are still killings, there are still human rights abuses,
and so the leak of this information does exacerbate their vulnerability,
it seems to us, and there's good credible evidence for that.
Speaker 1 (09:43):
You say that you're also representing claimants who are still
in Afghanistan. How difficult is that given that backdrop of
representing them and thinking about this case with people based
either in the UK or in Afghanistan.
Speaker 5 (09:57):
Yes, obviously those who remain in Afghanist and aren't particularly vulnerable,
and we were acting for them in this case, but
frankly we've also acted for others in previous cases. Which
is another point to make that this is just the latest,
or albit the most serious of a long line of
data breaches by the mt of of of those Afghans
(10:18):
that have assisted them. So there seems to be in
a very cavalier attitude towards towards those those people some
confidential information. But yes, there are difficulties in relation to
communications with those and in recent days we've obviously been
in communication with a number that remain in Afghanistan. Frankly
(10:41):
are very very worried.
Speaker 3 (10:43):
I've interested in the environment around these group legal actions.
How has that changed over the years, other more of
them these days?
Speaker 5 (10:51):
Yes, I think it's fair to say that the legal
profession in recent years has has has there have been
more more group claims in operation tovariety of different matters.
But in a way, if you think about it, it's
the way that one can bring these claims most economically.
What you don't want is thousands of thousands of separate
(11:12):
claims brought in a range of different courts presumably that
are essentially looking at the same matters. So what the
courts have decided to do is that they're the ones
that step up a procedure for this where you do
bring these claims as groups. But within that there are
obviously issues that are specific to the individuals, so their
(11:33):
group claims. But there is there is there is, you know,
also an analysis of individual situations in.
Speaker 1 (11:41):
Terms of the you talk about a pattern of behavior
by the mod that it effectively goes to the kind
of machinery of government that the cavalier attitude that you mention,
you clearly perceive a significant problem with adhering to the
gd PR rules. Is that still the case under this
(12:03):
labor government?
Speaker 3 (12:04):
Be fair.
Speaker 5 (12:05):
I don't have any kind of information in terms of
very recent situation, but I think just to give an example,
we're acting for other Afghans who affected by a serious
data breach and because in September twenty twenty one where
their names are put into of a group email, but
not as going to blind copy, but just so everyone
could see everyone else's names. And so that was that
(12:28):
was a serious breach and there were fines by the
Information Commission's Office, the regulator for that. Now what happened
after September twenty one is the Defense actually came to
the House, made a statement probably not that similar from
the statement made early this week, but then said, look,
we've now got our house in order, we've changed our policies,
(12:51):
we've changed our practice. This can't happen again. And then
lo and behold you now have the announcements are earlier
this week where there was this serious desh preach the
curve six months afterwards. Yeah. So I think the problem
is is that it is very difficult to know the
Mistery of Defense. I always keep saying it's learnt the lessons,
(13:13):
but these problems still keep on occurring.
Speaker 3 (13:17):
Suan, really good to get your thoughts on that. Seawan
Humber previously breached compensation specialist at law firm Lee Day,
clearly a really you know, chaotic state of affairs that
the Ministry of Defense are really really big mess up,
which has not only put a lot of people's lives
at risk but cost a huge amount of money.
Speaker 1 (13:35):
Well, listen former ministers Grant Shaps and Ben Wallace who
initially applied for the superinjunction and then the kind of
the follow up wider ranging superinjunction. Have both defended their
moves here that there was no apology for applying for
the initial injunction. The government has defended the actions that
(13:57):
they've taken to try to sort of mitigate the dangers
to the Afghan individuals who were named. So, look, I
think we're going to have to see what the government
does about this in terms of how much the projected
cost is of this relocation program at the moment eight
hundred and fifty million pounds. Let's see where the court
cases end up.
Speaker 3 (14:19):
Yeah, I'm the first ever used by the government of
a superinjunction, which course very significant in itself. Well, that's
it from us for today. If you like the program,
don't forget to subscribe and give it five stars so
other people can find it on Apple Podcasts, at Spotify,
or wherever you lis.
Speaker 1 (14:33):
This episode was produced by Harry Blackheart Audio Engineers Andrew Gavin.
I'm Caroline Hope Yet.
Speaker 3 (14:38):
And I'm your Impots. We're back with more next Friday.
Is Boomberg
Popular Podcasts
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Special Summer Offer: Exclusively on Apple Podcasts, try our Dateline Premium subscription completely free for one month! With Dateline Premium, you get every episode ad-free plus exclusive bonus content.
The Breakfast Club
The World's Most Dangerous Morning Show, The Breakfast Club, With DJ Envy, Jess Hilarious, And Charlamagne Tha God!
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.