5 ms·

Disappointing in the UK that two fines have been given to charities and NHS trusts trying to help trans people. Seems an ugly front in the culture war.

4ugSWklu 3y ago
Why is that disappointing? Are charities and NHS trusts that help trans people above the law?
- maxehmookau 3y ago
  No, of course not. I'm just curious why such a large proportion (14%) of GDPR fines in the UK have been handed to trans-friendly organisations. Sure, in isolation, they are obviously justified. But why such a focus?
  - hnbad 3y ago
    I don't think it's meaningful to talk about "a large proportion" with this few data points. They're serious privacy violations because of the nature of the data that was exposed. We're also only talking about two organizations, both of which did have legitimate privacy violation incidents. You're drawing conclusions based on statistically meaningless sample sizes.
Symbiote 3y ago
> This penalty has been issued because of contraventions by Mermaids of Articles 5(1)(f) and 32(1) and (2) of the GDPR in that during the period of 25 May 2018 to 14 June 2019 Mermaids failed to implement an appropriate level of organisational and technical security to its internal email systems, which resulted in documents or emails containing personal data, including in some cases relating to children and / or including in some cases special category data, being searchable and viewable online by third parties through internet search engine results. A fine for this seems reasonable. Data on sexuality and medical history is protected beyond the normal level for personal data.
Macha 3y ago
> On 15 August 2016, which is the date on which the email group of relevance to the contraventions set out in this notice was created, the Chief Executive Officer ("the CEO") was at that date the only paid staff member at Mermaids. On 14 June 2019, Mermaids were notified by a service user of the charity that internal emails containing personal data were publicly available online. Mermaids contacted the Commissioner later that day to report the concerns. On 17 June 2019, the CEO telephoned the Commissioner to update her and sent a follow up email detailing the remedial steps which Mermaids had taken £21,000 > At 14: 22 on 6 September 2019 a member of staff in the - used Microsoft Outlook to generate an email communication which was initially sent to a total of 1,781 GIC patients. The email was sent in two batches comprising 912 and 869 email addresses respectively. In both batches the email addresses were copied from the output report and entered into the "To" field instead of the "Blind carbon copy" ("Bee") field. The recipients of each email could therefore see the email addresses of the other recipients of that email. Four of the emails were returned as undeliverable and so potentially 1,777 emails were delivered and opened £92,000 I mean, they did accidentally dox their clients which is in scope for GDPR enforcement, and they are the 2nd and 3rd lowest fines (likely due to a low level of intentionality and resources), with the only lower fine going to a HIV charity. Honestly this seems fine.
GJim 3y ago
Are you seriously trying to suggest medical charities and trusts should be exempt from client data protection? The only 'culture war' here is the one you are introducing.
- maxehmookau 3y ago
  No, that's not what I'm saying. I made my point clumsily though, admittedly. I'm saying for the relatively few fines that have been issued in the UK, a surprising number have been aimed at targets of the culture war of the day and that that's noteworthy.
  - GJim 3y ago
    > aimed at targets of the culture war Data relating to medical records and sexuality is noted by the GDPR as (quite rightly) being particularly sensitive and worthy of extra protection. Your use of the troll bait term "culture war" attempts to belie this.
    - maxehmookau 3y ago
      I'm definitely not trying to bait, or troll anyone. I apologise if that's how it's coming across. I found the proportion of the fines aimed at a particular group of organisations noteworthy; especially specific organisations that are already under intense scrutiny in the UK media.
- hnbad 3y ago
  The implication here is that this stands out because others haven't been fined. I'm not up to date enough on UK privacy violations to be able to tell whether that is the case. Charities have to obey privacy law the same as anybody else regardless of what they stand for. It seems the fines were perfectly justified and I see no problem with that. That said, pretending there is not a deliberate "culture war" around the existence of trans people in the UK is either dishonest or ignorant. UK politics, politicians and media have been extremely hostile towards trans people in recent years even relative to the general attitude of the general population in the UK. The level of artificial moral panic surrounding trans people in UK politics and media is surprising even by American standards. There are a number of astroturfed anti-trans groups present in English-speaking media but the most effective ones are all UK-centric. The fines, however, seem to be orthogonal to that.

4ugSWklu 3y ago

Why is that disappointing? Are charities and NHS trusts that help trans people above the law?

maxehmookau 3y ago
No, of course not. I'm just curious why such a large proportion (14%) of GDPR fines in the UK have been handed to trans-friendly organisations. Sure, in isolation, they are obviously justified. But why such a focus?
- hnbad 3y ago
  I don't think it's meaningful to talk about "a large proportion" with this few data points. They're serious privacy violations because of the nature of the data that was exposed. We're also only talking about two organizations, both of which did have legitimate privacy violation incidents. You're drawing conclusions based on statistically meaningless sample sizes.

Symbiote 3y ago

> This penalty has been issued because of contraventions by Mermaids of Articles 5(1)(f) and 32(1) and (2) of the GDPR in that during the period of 25 May 2018 to 14 June 2019 Mermaids failed to implement an appropriate level of organisational and technical security to its internal email systems, which resulted in documents or emails containing personal data, including in some cases relating to children and / or including in some cases special category data, being searchable and viewable online by third parties through internet search engine results. A fine for this seems reasonable. Data on sexuality and medical history is protected beyond the normal level for personal data.

Macha 3y ago

> On 15 August 2016, which is the date on which the email group of relevance to the contraventions set out in this notice was created, the Chief Executive Officer ("the CEO") was at that date the only paid staff member at Mermaids. On 14 June 2019, Mermaids were notified by a service user of the charity that internal emails containing personal data were publicly available online. Mermaids contacted the Commissioner later that day to report the concerns. On 17 June 2019, the CEO telephoned the Commissioner to update her and sent a follow up email detailing the remedial steps which Mermaids had taken £21,000 > At 14: 22 on 6 September 2019 a member of staff in the - used Microsoft Outlook to generate an email communication which was initially sent to a total of 1,781 GIC patients. The email was sent in two batches comprising 912 and 869 email addresses respectively. In both batches the email addresses were copied from the output report and entered into the "To" field instead of the "Blind carbon copy" ("Bee") field. The recipients of each email could therefore see the email addresses of the other recipients of that email. Four of the emails were returned as undeliverable and so potentially 1,777 emails were delivered and opened £92,000 I mean, they did accidentally dox their clients which is in scope for GDPR enforcement, and they are the 2nd and 3rd lowest fines (likely due to a low level of intentionality and resources), with the only lower fine going to a HIV charity. Honestly this seems fine.

GJim 3y ago

Are you seriously trying to suggest medical charities and trusts should be exempt from client data protection? The only 'culture war' here is the one you are introducing.

maxehmookau 3y ago
No, that's not what I'm saying. I made my point clumsily though, admittedly. I'm saying for the relatively few fines that have been issued in the UK, a surprising number have been aimed at targets of the culture war of the day and that that's noteworthy.
- GJim 3y ago
  > aimed at targets of the culture war Data relating to medical records and sexuality is noted by the GDPR as (quite rightly) being particularly sensitive and worthy of extra protection. Your use of the troll bait term "culture war" attempts to belie this.
  - maxehmookau 3y ago
    I'm definitely not trying to bait, or troll anyone. I apologise if that's how it's coming across. I found the proportion of the fines aimed at a particular group of organisations noteworthy; especially specific organisations that are already under intense scrutiny in the UK media.
hnbad 3y ago
The implication here is that this stands out because others haven't been fined. I'm not up to date enough on UK privacy violations to be able to tell whether that is the case. Charities have to obey privacy law the same as anybody else regardless of what they stand for. It seems the fines were perfectly justified and I see no problem with that. That said, pretending there is not a deliberate "culture war" around the existence of trans people in the UK is either dishonest or ignorant. UK politics, politicians and media have been extremely hostile towards trans people in recent years even relative to the general attitude of the general population in the UK. The level of artificial moral panic surrounding trans people in UK politics and media is surprising even by American standards. There are a number of astroturfed anti-trans groups present in English-speaking media but the most effective ones are all UK-centric. The fines, however, seem to be orthogonal to that.