Website Cookie Policy

We use cookies to give you the best possible online experience. If you continue, we’ll assume you are happy for your web browser to receive all cookies from our website.
See our cookie policy for more information.

Practice Areas

More Information

thepartners@wrigleys.co.uk

Leeds: 0113 244 6100

Sheffield: 0114 267 5588

FOLLOW WRIGLEYS:

Send us an enquiry
Close

ICO fines charity £25,000 for failing to secure personal data

09 July 2021

The Information Commissioners Office (“ICO”) has published its decision to fine the charity Mermaids £25,000 following a data breach.

Mermaids reported the breach to the ICO in 2019, following the discovery of a failure to appropriately secure the personal data of its beneficiaries. 

An internal email group was set up by Mermaids in 2016 and continued until 2017. The group was set up with inadequate security settings, such that over 700 pages of emails and 550 email addresses were accessible when searched for online.

The sensitive personal data of 24 beneficiaries’ experiences and feelings was available freely. In addition, the special category personal data about the mental and physical health and sexual orientation of a further 15 beneficiaries, which is afforded particular protection in data protection law, was publicly available as a result of the data breach. All the information was publicly accessible for nearly three years.

The ICO has taken a firm approach to dealing with Mermaids and, in its investigation, the ICO identified a complacency within Mermaids as to the requirement to keep personal data safe and to undertake the training for its staff in data protection practices.

The ICO also criticised Mermaids for failing to update its policies following the implementation of the UK GDPR and wider societal conversations surrounding gender identity.

Whilst Mermaids has since taken significant steps to improve its practices and co-operated with the investigation fully, the ICO still found these breaches sufficiently serious to fine Mermaids £25,000 as a consequence of this breach. In imposing such a substantial fine, the ICO is sending a clear message to the sector that it will not take a lenient approach to enforcement with charities.

This case serves to act as a reminder to all charities, in particular those dealing with sensitive or special category personal data, that it is their duty to:

  • protect the personal data they control;
  • continue to review and update their data protection policies and procedures taking account of fresh guidance and best practice; and
  • keep staff appropriately trained to minimise the risk of data protection breaches.

Wrigleys can support you with your data protection obligations.  If you have any questions or we can assist please contact Nick Dunn or any other member of Wrigleys data protection team on 0113 244 6100. 

Nick Dunn View Biography

Nick Dunn

Solicitor
Leeds

06 Dec 2021

Sold from under your feet

We look at property fraud and how the Land Registry can help prevent it.

03 Dec 2021

**Wrigleys’ Essential Guide** The Disciplinary Process

How thorough should an investigation be?

02 Dec 2021

Pensions considerations for Students’ Unions

While SUs have a variety of more pressing matters to consider, pensions are often the largest liability a SU carries.