The Weekly Round Up: Afghan data breach, Palestine Action appeal, protest rights and state immunity
3 August 2026
In the news
Parliamentary report on the Afghan data breach
On Thursday, the House of Commons Defence Select Committee (DSC) published a report which found that a serious data breach of the sensitive personal data of thousands of Afghans was a ‘foreseeable systemic failure’ that became part of a wider failure of governance, accountability and public trust [30].
In February 2022, a member of the Ministry of Defence (MoD) sent a spreadsheet to a trusted third party which mistakenly contained detailed personal information relating to over 18,500
Afghan Relocation and Assistance Policy (ARAP) applications [45]. The breach was not discovered until August 2023, when part of the dataset appeared in a Facebook group [63].
The Shifting heaven and earth? The Afghan data breach and resettlement schemes report found that the MOD handled sensitive immigration casework using tools and controls ‘not appropriate for a life-endangering dataset’, which contained the personal information of Afghans who faced danger from the Taliban in connection with their work with or for the UK. DSC chair, Tom Dhesi, said that the MoD “should never have been left to run immigration casework schemes”.
From September 2023, for nearly two years, an ‘unprecedented superinjunction’ prevented media outlets from reporting on the incident [2]. The report found that the government did not strike ‘the right balance between operational secrecy and democratic accountability’ [97] and warned that the case should not set a precedent for normalising injunctions that suppress matters of widespread public interest [104].
The report also raised concerns that the government’s ‘self-move’ policy – which requires eligible Afghans to make their own way to a third country within twelve months – announced in April, ‘risks becoming in practice an exclusion mechanism for eligible people who are too poor, too vulnerable or too exposed to travel independently’ [215]. The DSC called on the government to publish a clear policy explaining how they will help Afghans who are eligible to come to the UK but who have not yet been evacuated.
In the courts
Animal activists challenge protest regulations
This week, the High Court granted animal rights campaigners permission to apply for a judicial review of the Public Order Act 2023 (Interference With Use or Operation of Key National Infrastructure) Regulations 2026 (‘the Regulations’).
The Regulations classify ‘life sciences infrastructure’, including animal testing facilities, as ‘key national infrastructure’. Under Section 7 of the Public Order Act 2023, interfering with the use or operation of key national infrastructure is a criminal offence punishable by up to 12 months’ imprisonment, a fine, or both.
Before Parliament approved the Regulations, a coalition of animal welfare charities wrote to the home secretary, Shabana Mahmood, warning that the measures would restrict ‘lawful, peaceful protest against animal experimentation’ and create a ‘fear of excessive criminalisation’.
Animal Aid challenges the Regulations on two grounds. First, it argues that the definition of ‘life sciences infrastructure’ goes beyond the natural meaning of the term ‘infrastructure’ and extends the concept of ‘key national infrastructure’ beyond Parliament’s intention. Second, Animal Aid argues that by not consulting animal rights groups, the Secretary of State failed to conduct a lawful consultation on the proposed Regulations.
Lawyers for Animals and Maria Iriart, a campaigner with Camp Beagle, also announced this week that the High Court had granted permission in their separate judicial review. Their claim is brought on two grounds. First, they argue that the Home Secretary exceeded her powers by classifying the life sciences as ‘key national infrastructure’. Second, they argue that the Regulations are irrational because existing criminal offences already protect the sector, the Government has produced no meaningful evidence to justify the claimed risks and the concept of ‘interference’ is insufficiently defined.
Palestine Action
On Wednesday, Palestine Action’s co-founder, Huda Ammori, was granted permission to appeal to the Supreme Court against the Court of Appeal’s decision that the former home secretary, Yvette Cooper, had acted lawfully when banning the group last year under the Terrorism Act 2000.
In February, the Divisional Court in R (Ammori) v Secretary of State for the Home Department [2026] EWHC 292 (Admin) held that the proscription breached the rights to freedom of expression and assembly, as guaranteed by Articles 10 and 11 ECHR, and that the Home Secretary failed to properly apply her policy on the discretion to proscribe. The Court of Appeal in Secretary of State for the Home Department v R (Ammori) [2026] EWCA Civ 721 overturned that decision in June, finding in favour of the Home Secretary.
The hearing is to be expedited and is due to be heard before the end of the year.
For further detail, see Jonathan Metzer’s in-depth analysis of both the Divisional Court’s and Court of Appeal’s judgments for the UK Human Rights Blog. You can also hear him discussing the Divisional Court’s ruling with Lucy McCann in episode 233 of Law Pod UK and the Court of Appeal’s reversal in episode 240.
Kingdom of Bahrain v Shehabi and Mohammed [2026] UKSC 25
On Monday, the Supreme Court ruled that a foreign state cannot invoke state immunity in proceedings relating to personal injury caused by acts within the UK, even if other causative acts take place abroad and the actor is not present in the UK [134].
The case stems from a claim brought by Bahraini activists, Dr Saeed Shehabi and Moosa Mohammed, who allege that agents of the Kingdom of Bahrain installed and operated spyware on their computers [8]. At the time the spyware was allegedly installed and used, both activists and their computers were located in the UK. However, the spyware was allegedly operated by Bahraini agents from outside the UK via a server located in Bahrain [156].
The central issue before the Court was whether the ‘territorial tort exception’ in section 5 of the State Immunity Act 1978 (SIA) would apply in cases where the actors or some of the acts causing personal injury were located outside the UK [49]. Section 5 of the SIA provides that a foreign state cannot rely on state immunity to escape accountability for death, personal injury or property damage ‘caused by an act or omission in the United Kingdom’ [1].
The Supreme Court held, by a majority of 3 to 2, that limiting the scope of section 5 of the SIA to situations where an agent of a foreign state was present in the UK at the time when the acts which caused the injury occurred (a presence requirement) would be ‘an unduly restrictive reading’ and fail to take account of the ability of modern technology to carry out acts remotely from abroad [133]. The Court emphasised that a rigid distinction between an act and its effects can lead to ‘artificial and unprincipled results’ [129].
Although article 11 of the European Convention on State Immunity (ESCI) expressly imposes a presence requirement, the Court held that the principle of consistent interpretation had no application [77]. The SIA was not intended to be a precise implementation of the ECSI and Parliament had made a ‘deliberate decision’ to depart from the ECSI scheme in this particular respect [76].
