VFS Global - Controversy

Controversy

In May 2007 it was reported that the company's online UK visa application system was flawed. It was also reported that the security flaw had affected online applications from India, Nigeria and Russia. The VFS site was immediately shut down after the technical problem was brought to the attention of the UK media and an independent government investigation was launched by the British Foreign & Commonwealth Office (FCO). The security breach was first reported by an Indian applicant in December 2005 after which no effective remedial action was taken by either VFS nor UKvisas, the joint Home Office and Foreign & Commonwealth Office unit which runs the UK's visa service through British diplomatic posts overseas. The same applicant went public in May 2007 after he noticed that his earlier warnings were ignored. It is estimated that this security breach had resulted in approximately 50,000 applicants' identities having been possibly compromised until its May 2007 closure, following the media outcry.

The report of the investigation by the Independent Investigator, Linda Costelloe Baker highlighted organisational failures by both VFS and UKvisas. The report also recommended that the VFS online visa applications not be resumed for applications from India. This has since been replaced by the secure online applications made available directly at the Visa4UK official government website of the UK Border Agency.

Baker also mentioned in the report that following this incident, UKvisas conducted extensive testing and found no evidence that data had been stolen or misused. VFS underestimated what was necessary in order to protect personal data to the levels expected by the UK Data Protections Act. After this incident, several visa application level checks were put in place. Technical processes were also upgraded later to check the records of the online application site.

In November 2007, the UK Information Commissioner's Office announced that it had found the Foreign Office in breach of its obligations under the Data Protection Act 1998. The Information Commissioner's Office required the Foreign Office to sign a statement that it would comply with the Data Protection Act and would not reopen the VFS UK visa online facility. It has been reported by The Guardian that as a result of this ruling, the Foreign Office would review its relationship with VFS and seek to significantly reduce its outsourced work, especially in the area of IT. Consequently, applicants from India today need to apply directly at the Visa4UK official government website for online visa applications.

After the report was issued, VFS introduced various measures to ensure safe and secure business environment. One of them was to make all its centres ISO compliant.

However, since this incident several governments have been critical of VFS Global's abilities and have raised concerns over security. "There's the accountability issue, the privacy issue and why are we outsourcing to a for-profit entity something that belongs in the security mandate?" asked Victor Wong, executive director of the Chinese Canadian National Council. Liam Clifford of global visas, a migration advice company, told The Sunday Telegraph: "Once you put this work in the hands of private companies overseas, you no longer have the same protection."

The controversy over information disclosure was particularly difficult for the British Government which was still recovering from the NHS Medical Training Application Service scandal, an online service that had to be suspended following reports of a similar security breach.