# UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Information Commissioner (ICO)
- Date: 2023-12-13
- Original: https://www.enforcementtracker.com/ETid-2170
- Canonical: https://overview.legal/posts/48285
- Topics: Personal Data, IP Address, Security, Education, Processing Agreement, Public Authority, Human Resources, Public Sector, Law Enforcement, Supervisory Authorities

## Summary

The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of Afghanistan in 2021. The Ministry of Defense had sent an email to a distribution list of Afghan nationals who were eligible for evacuation without hiding the e-mail adresses and thus revealing the personal e-mail addresses and personal data of the recipients to the other e-mail recipients. The ICO stated that if the data had fal

## Full text

The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of Afghanistan in 2021. The Ministry of Defense had sent an email to a distribution list of Afghan nationals who were eligible for evacuation without hiding the e-mail adresses and thus revealing the personal e-mail addresses and personal data of the recipients to the other e-mail recipients. The ICO stated that if the data had fallen into the hands of the Taliban, it could have led to a threat to lives.

GDPR Articles: Unknown
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/48285 · 2026-08-22