Home Office’s visa service apologises for email address data breach

The Home Office's visa service has apologised for a data breach in which the email addresses of more than 170 people were mistakenly copied into an email circulated last week.

More than 170 email addresses were accidentally copied into a message on 7 April 2022 about the change of location for a visa appointment with the UK Visa and Citizenship Application Service. The UKVCAS is run on behalf of the Home Office by the private contractor Sopra Steria. Some of the email addresses appeared to be private Gmail accounts, while others belonged to lawyers from a variety of firms.

Just after 5pm on 8 April an email apologising for the data breach was circulated. It referred to a "data breach error" and apologised for any inconvenience caused.

It stated: "This email included the email addresses of other customers, which is not our usual practice. It did not include any other personal information. At UKVCAS we take data protection very seriously."

"We are reviewing our internal processes to prevent this error from occurring in the future," the email added. The original email was recalled and a correct version sent out.

Naga Kandiah of MTC Solicitors, one of the recipients of the email, condemned the data breach. He said: "If the Home Office wishes to outsource biometric appointments to a third-party company they have to ensure that their partner is providing a service which is both legally compliant and good value for money.

"UKVCAS are charging far in excess of what was previously paid for an appointment at the Post Office yet the product is inferior. For such a high price clients do not expect GDPR breaches or loss of data."