Ministry of Defence: Data Protection — Written Question

Question

John Healey

Labour — Rawmarsh and Conisbrough

To ask the Secretary of State for Defence, pursuant to the Answer of 24 April 2023 to Question 181353 on Ministry of Defence: Data Protection, how many people were affected by each of the personal data incidents that occurred within his Department in 2022; and what was the nature of each of these incidents.

Answer

Dr Andrew Murrison

The Ministry of Defence (MOD) notified the Information Commissioner’s Office of seven data protection incidents in 2022.

Incident	Data Subjects affected		Date reported to the ICO
A non-MODnet network was infected with malware.		263	07/01/2022
Sharing of e-mail contact details through a distribution list of individuals seeking ARAP support.		10	08/02/2022
An individual shared the content of a service complaint they had raised.		22	01/03/2022
Details of Army recruitment candidates were leaked to the dark web by Twitter activists.		124	22/03/2022
A laptop, notebook, and electronic storage device were stolen.		10	18/03/2022
Due to incorrect redaction technique being used by a member of staff in breach of MOD policy, an individual's name was disclosed in a Freedom of Information request.		1	06/07/2022
As part of recovery action on a system following a system outage, 9 files attached to medical notes relating to service personnel were found to be unrecoverable.		9	05/10/2022

This information is also published in the MOD Annual Reports and Accounts by Financial Year – please see 20220714_MOD-ARA_2021-22_PRINT.pdf (publishing.service.gov.uk) (pages 67-69) for the most recent iteration.