Super-injunctions back in the spotlight

Posted Tuesday 2nd September 2025

The term “super-injunction” entered the public lexicon back in 2010 following a number of high-profile cases in which the Court granted interim relief to prevent the publication of private material, as well as the publication of the existence of the proceedings themselves. This resulted in the Master of the Rolls producing practice guidance around the use of interim non-disclosure orders (i.e. injunctions) in 2011.

The term has over the years been confused with privacy injunctions – the latter being where an individual seeks an injunction (anonymously) to prevent the publication of private information (quite often involving extra-marital affairs and footballers!). However, in those cases, the press is able to report on the existence of the injunction (just not the identities of those involved).

A super-injunction is a rarely used court order which prohibits disclosure not only of underlying information but also of the existence of the order itself. Where such injunction is granted contra mundum (against the world), it binds everyone who has notice of it.

The super-injunction was back in the news in July 2025 as it was widely reported that the Ministry of Defence had obtained a “super-injunction” to prevent the disclosure of a highly sensitive dataset including the personal data of Afghan nationals which had been subject to a data breach.

Given the injunction was obtained in September 2023, questions have been rightly asked about the length of time the injunction remained in place, preventing the press and others from scrutinising, not only the original data breach, but also the steps taken by the Government following discovery of the breach.

The various judgments (including one from the Court of Appeal) all acknowledge the unprecedented set of circumstances that led to the injunction being granted, and continued for the length of time that it was.

The injunction was in fact discharged by the first instance judge in May 2024, only for it to be overturned by the Court of Appeal.

Whilst it could certainly be argued that the need for the “super” element of the injunction may have no longer been justified over a year on from the initial application, I was surprised that the Judge was prepared to discharge the injunction in its entirety on the basis of the evidence before the Court.

At its most basic level, the information wrongly disclosed in the data breach was confidential information which the Court had accepted had not lost the necessary quality of confidence and was capable of protection. To essentially permit such a significant number amount of personal data to be freely disseminated seemed unjustified. Injunctions following data breaches are routinely sought by data controllers on the basis that the information retains its confidential qualities.

It does appear that the MoD notified the ICO of the breach in 2023 (although the ICO’s statement does not say when). The ICO’s statement confirms that the data breach involved the sharing of spreadsheets with “hidden rows”, but questions must surely be asked about why such sensitive data was held in this form and why it was seemingly left to an individual to take responsibility for sanitising the data before it was sent. It is clear from the Court judgments that no notification to the data subjects in fact took place – a requirement under Article 34(1) GDPR.

There are lessons from this unfortunate episode that can be applied to all who are involved in the processing of personal data – particularly around the sharing of data in spreadsheets. It is also likely to prompt more discussion around the court’s jurisdiction to grant super-injunctions.

However, for the next couple of years, I expect those of us who practice in this area will be closely following the claims for compensation of the data subjects following the breach. It is ironic that the leading case in this area around appropriate levels of compensation following a data breach is that of TLT, a claim brought by a number of asylum seekers against….the Home Office.

Alex Vakil is a partner at Joelson with a specialism in commercial litigation and reputation management.

---

This article is for reference purposes only. It does not constitute legal advice and should not be relied upon as such. Specific legal advice about your specific circumstances should always be sought separately before taking or deciding not to take any action.

---

Share this article