Home Office’s visa service apologises for email address data breach

The Home Office's visa service has apologised for a data breach in which the email addresses of more than 170 people were mistakenly copied into an email circulated last week.

More than 170 email addresses were accidentally copied into a message on 7 April 2022 about the change of location for a visa appointment with the UK Visa and Citizenship Application Service. The UKVCAS is run on behalf of the Home Office by the private contractor Sopra Steria. Some of the email addresses appeared to be private Gmail accounts, while others belonged to lawyers from a variety of firms.

Just after 5pm on 8 April an email apologising for the data breach was circulated. It referred to a "data breach error" and apologised for any inconvenience caused.

It stated: "This email included the email addresses of other customers, which is not our usual practice. It did not include any other personal information. At UKVCAS we take data protection very seriously."

"We are reviewing our internal processes to prevent this error from occurring in the future," the email added. The original email was recalled and a correct version sent out.

Naga Kandiah of MTC Solicitors, one of the recipients of the email, condemned the data breach. He said: "If the Home Office wishes to outsource biometric appointments to a third-party company they have to ensure that their partner is providing a service which is both legally compliant and good value for money.

"UKVCAS are charging far in excess of what was previously paid for an appointment at the Post Office yet the product is inferior. For such a high price clients do not expect GDPR breaches or loss of data."

The Home Office previously apologised to hundreds of EU citizens for accidentally sharing their email addresses in April 2019. In the same month the former immigration minister Caroline Nokes apologised to the Windrush generation after about 500 email addresses were mistakenly shared with recipients of a mailing list for the compensation scheme.

The Information Commissioner's Office said: "We do not appear to have received a data breach report from the Home Office on this matter. Not all data breaches need to be reported to the ICO. Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, unless it does not pose a risk to people's rights and freedoms.

"If an organisation decides that a breach doesn't need to be reported they should keep their own record of it, and be able to explain why it wasn't reported if necessary."

A Home Office spokesperson said: "We take data protection extremely seriously and there are robust processes in place to prevent breaches. On the rare occasion they do occur, data incidents which meet the appropriate threshold are reported to the Information Commissioner's Office. Our data protection officer is reviewing this incident to determine whether this threshold has been met."