Why might a public inquiry be into the data breach by the Ministry of Defence be beneficial?

It appears to be universally accepted across the political spectrum that the data breach by the Ministry of Defence (“MOD”) involving the personal details of applicants to the Afghan Relocations and Assistance Policy (“ARAP”) is a very serious issue that requires careful investigation and scrutiny. The seriousness of this matter has been reinforced by the recent revelation that the data breach included personal information of members of the Special Forces and secret services.

The form of any investigation has not yet been decided. Tan Dhesi MP, the Labour chairman of the Defence Select Committee in Parliament told the BBC: "I'm not sure whether a public inquiry will or will not happen, but one thing you can rest assured on is that the defence committee has decided that we will be launching an inquiry to ascertain exactly what transpired here, given the serious ramifications on so many levels”. While Ed Davey MP, leader of the Liberal Democrats, has led the call for a public inquiry into the data breach, Kier Starmer has not rule it out.

What are the issues that need to be investigated?

There are many issues that need to be investigated in relation to the MOD’s data breach, but below is a non-exhaustive list of questions that require answering:

• How was this data breach allowed to happen?
• How was it possible for a member of the Special Forces to send out via email a document containing the personal data of tens of thousands of individuals without any checks and balances?
• Were there any processes in place at the MOD to ensure checks and balances regarding the storage and dissemination of personal information?
• Why did it take 18 months for the MOD to find out about the data breach?
• How did the leaked information find its way onto Facebook?
• Why did the MOD (mostly) not notify those on the list of the breach and how was this decision arrived at?
• Did the government’s inadequate system for identifying, prioritising and evacuating at-risk Afghans to the UK following the British evacuation in 2021 increase the likelihood of such a data breach occurring? Is this data breach a consequence of poor crisis response?
• Was it appropriate, constitutional or democratic for successive governments to apply for a super-injunction preventing the media from reporting on this issue?
• What evidence did the current government rely on to suggest that those listed in the leak are now safe from the Taliban? Given the publicly available evidence of Taliban reprisals since their takeover, is this evidence sound?
• What steps have been taken to address the root cause of the breach and ensure that it cannot happen again?
• Why did the UK Government close the ARAP scheme to new applications on 1 July 2025?

Why might a public inquiry be preferable to a parliamentary investigation?

A statutory public inquiry, namely one established under the Inquiries Act 2005, would be a quasi-judicial investigation into the breach. It would investigate what happened and make recommendations to try and ensure nothing like this happens again in the future.

Select committees are also mechanism to investigate and report on specific issues. They can be cross-party groups of MPs or Lords (or both) charged by parliament with a specific role or with investigating a specific issue. Select committees form part of the machinery of our parliamentary democracy and are designed as a tool for holding government to account.

Given that this scandal has straddled governments of both political parties, it may be preferable to have a public inquiry due to its independence from the government of the day or parliament in general. In the political context where politicians from both Labour and the Conservatives may seek to lay blame at each other’s door, it may not sit right with the public if a parliamentary select committee made up of politicians from both parties investigates this matter.

The different powers of a select committee or a statutory public inquiry may also inform the decision as to the nature of any investigation. While the exact powers delegated to select committees vary, select committees usually include the ability to “send for persons, papers and records”. This is the key evidence-gathering power of a select committees, and includes the power to call witnesses. However, this power has a sign a significant limitation, namely that it cannot compel MP’s, Lords, or government ministers to attend to give evidence. On the other hand, statutory public inquires, under Section 21 of the Inquiries Act 2005, have the power to compel witness evidence from anyone in this jurisdiction.

Statutory public inquiries also differ from select committee inquiries in that they typically involve greater public involvement, transparency and meaningful participation for those affected.

It remains to be seen whether the government will commit to a statutory public inquiry. It may also be that there is both a public inquiry and an investigation by the Defence Select Committee. We will continue to monitor developments in this space.

As outlined in our previous article on this subject, whether or not an investigation into this matter takes the form of a public inquiry, there are likely to be other legal processes that arise out of the MOD’s data breach, including compensation claims against the MOD. There may also be a judicial review challenge of the decision to suspend new applications to the ARAP scheme from 1 July 2025.

At Saunders Law, we have a dedicated expert team specialising in public inquiries who have been instructed to act for individuals and non-state groups affected by the Grenfell Tower Inquiry, Infected Blood Inquiry, and the ongoing Covid-19 Inquiry & Undercover Policing Inquiry. We also have a dedicated team with experience of bringing individual and group compensation claims against state bodies.