The government applied for a time-limited injunction to prevent the release of information about a 2022 data breach affecting thousands of Afghans who had worked with the UK, but a judge's additions turned it into a superinjunction, according to a report from MPs.
Background of the breach
The UK had a military presence in Afghanistan between 2001 and 2021, during which many Afghans worked with the UK Government. These people and their families were at risk of reprisals from the Taliban, especially after it retook control of the country following the US's withdrawal. A new way of assessing whether these people should be relocated to the UK was launched in 2021.
The Ministry of Defence (MoD) did not have the systems in place to deal with the administration of these efforts, so developed them "at pace." When an MoD worker sent an Excel file with information on 150 of the applicants to a "trusted third party" outside the Government, they were apparently unaware there was hidden data within the spreadsheet. This data included "detailed personal information" of more than 18,500 other applicants. This happened in February 2022, and the mistake was not discovered by the MoD until August 2023.
The decision to seek an injunction
A judge in the case, Mr Justice Knowles, said in his ruling he had been informed that the secretary of state for defence "personally" took the decision to apply for an injunction on August 25 2023 to stop reporting on the data breach. This was intended to be a time-limited injunction. The purpose was to "preserve the confidentiality of the personal information for as long as possible" so that the government could do what it could to "help those who might have been put at further risk by the data compromise." Mr Justice Knowles added in his reasoning: "The risk in question is to the lives of many individuals and their families, and of torture."
The MoD had suggested that the judge's order should be published on the court's website, but it was the judge himself who decided to keep it in private and not publish it "at least at this stage." The judge also changed what information would be available to those on whom the order was served.
Was it a superinjunction?
A superinjunction is a court order that not just bans the disclosure of information, but also bans anyone from disclosing the existence of the order itself. A report from the House of Commons' Defence Committee said the judge's actions had gone further than the MoD's initial request. The committee's report said: "In practice, it turned the injunction into a superinjunction." It added: "The government applied for a contra mundum injunction to prevent disclosure; the court added the provisions that made the order a superinjunction in practice. Responsibility should therefore be distinguished carefully. The government is responsible for seeking secrecy and for operating within and benefiting from the order. But the exact legal form that secrecy took was decided by the court, not simply chosen by ministers."
A later judgment from Mr Justice Chamberlain confirms this. He said: "In their original application, the Government did not seek relief in the form of a 'superinjunction' (ie one which prevented publication of the existence of the order and proceedings). However, on 1 September 2023, Robin Knowles J nonetheless granted a super-injunction contra mundum."
The timing
The case was brought to Mr Justice Knowles on September 1 2023 and he made the order the following day. Sir Ben's time as Defence Secretary had ended on August 31. So while he took the decision on August 25 to apply for an injunction, Sir Ben was not defence secretary at the time of the hearings. On September 1 2023, Sir Grant Shapps was defence secretary. The committee report said: "It therefore fell to Grant Shapps to operate within the discretion granted by the High Court, and Ben Wallace's original intent became a matter of context rather than control."
