Recommendation 16

The government approached notification of affected Afghans primarily as a communications exercise rather than as a safeguarding intervention. Although the notification reached most affected individuals, it did not provide sufficiently specific, actionable or individualised information to enable people to understand their level of risk, what data relating to them or their families had been compromised, or what practical steps 71 they could take. Nor was it supported by an adequate system of follow-up engagement, case-specific advice or assistance. Given the time available to plan for disclosure and the foreseeable reaction of people receiving notice of a potential risk-to-life data breach—many of whom were in Afghanistan or precarious third-country settings—the government should have treated notification as an immediate operational response to safeguarding need, not simply as public messaging. (Conclusion, Paragraph 161)