ICO fines charity £25,000 for failing to secure personal data

The Information Commissioners Office (“ICO”) has published its decision to fine the charity Mermaids £25,000 following a data breach.

Mermaids reported the breach to the ICO in 2019, following the discovery of a failure to appropriately secure the personal data of its beneficiaries. 

An internal email group was set up by Mermaids in 2016 and continued until 2017. The group was set up with inadequate security settings, such that over 700 pages of emails and 550 email addresses were accessible when searched for online.

The sensitive personal data of 24 beneficiaries’ experiences and feelings was available freely. In addition, the special category personal data about the mental and physical health and sexual orientation of a further 15 beneficiaries, which is afforded particular protection in data protection law, was publicly available as a result of the data breach. All the information was publicly accessible for nearly three years.

The ICO has taken a firm approach to dealing with Mermaids and, in its investigation, the ICO identified a complacency within Mermaids as to the requirement to keep personal data safe and to undertake the training for its staff in data protection practices.

The ICO also criticised Mermaids for failing to update its policies following the implementation of the UK GDPR and wider societal conversations surrounding gender identity.

Whilst Mermaids has since taken significant steps to improve its practices and co-operated with the investigation fully, the ICO still found these breaches sufficiently serious to fine Mermaids £25,000 as a consequence of this breach. In imposing such a substantial fine, the ICO is sending a clear message to the sector that it will not take a lenient approach to enforcement with charities.

This case serves to act as a reminder to all charities, in particular those dealing with sensitive or special category personal data, that it is their duty to:

• protect the personal data they control;
• continue to review and update their data protection policies and procedures taking account of fresh guidance and best practice; and
• keep staff appropriately trained to minimise the risk of data protection breaches.

Wrigleys can support you with your data protection obligations.  If you have any questions or we can assist please contact Nick Dunn or any other member of Wrigleys data protection team on 0113 244 6100.