Government · Recipient privacy Accidental data breach
UK Ministry of Defence: a recipient list became a disclosure
- Incident
- September 2021 group emails
- Source report
What was reported
The ICO records disclosure of 265 unique email addresses when the Ministry of Defence used visible recipient fields instead of blind copying. A parliamentary statement identifies the incident as September 2021 group emails connected to the Afghan relocation programme. The ICO listing records a £350,000 fine. This briefing concerns those emails, not the separate Afghan-data incident publicly disclosed in 2025.
Read the report from Information Commissioner’s Office
December 13, 2023 parliamentary statement on the 2021 emails
Our perspective
Our reading: Drafting a message and accessing its distribution list are different needs. In an AI-assisted workflow, Vivendur’s intended permissions could separate message context from recipient identities and limit which tool receives each.
Explore task-specific accessLimits of this connection
Email delivery safeguards and a final recipient review remain essential. A context layer does not, by itself, enforce how an external mail service addresses a message.