Heads up to all ManFriday members

Tevealing I've no doubt you are a DP professional but like a lot of DP professionals I know I suspect that you are so far down the DP rabbit hole that you believe that DP is the tail that must wag the dog, and fail to see beyond the DP bubble.
MF is the name of a campaign, it is not an organisation. (Unincorporated or not)
Stop giving women involved in MF a kicking and look to the leaker instead.

Seeing a gang attacking one person sickens me...no matter what the justification, it is nasty bulling and a campaign group turning into a lynch mob is not a good look.

I have yet to see any evidence posted here that the person suspected actually did this dastardly deed. It seems to be just assumed.

I would have provided - free

a toolkit for data mapping - I would do a data map and then leave the toolkit for use afterwards by anyone else who needed to use it

DPIAs for every area where I identified a risk and each project/campaign that was currently being undertaken and a template left for use afterwards

A data protection policy covering: the history of the organisation in question, the theory behind the GDPR, volunteer specific guidance, role of the ICO, how to handle data requests, redaction of personal information and how to do that, anonymization of personal data, data sharing, PECR and the e-privacy directive, privacy notice, data breach report form, subject access request form, change of details form, obligations as data processor under GDPR, obligations as data controller under GDPR, third party processing agreement if required and a template left if needed for future, confidentiality agreement, information security policy and best practice around use of personal devices, and a records management policy.

For free. But I know fuck all

Sorry - Isle of Man info, French toolkit is where the templates are to be found.

I was offering to provide an adapted version for ManFriday but well, I'm sure you'll understand that I don't feel quite so content so to do now.

1. no you werent you were scaremongering and giving out incorrect info.

2. nobody asked you to do anything or write any policies so its no great loss is it...

I also include templates which are based on the ICO templates with some amendments taken from the Isle of Man templates (which are most excellent by the way) for further DPIA should procedures need to change in future, or should there be a large piece of work required that would benefit from a DPIA.

Also act as DPO for currently 4 organisations of that type (campaigning/community) FOC.

But sure, I know fuck all.

Data protection and information security policy incorporating DPIA (with risk assessments etc) fair processing notices, privacy notice for a website if required, all that. I have a standard one that I drew up in advance of GDPR and that I use for charitable organisations (small community groups for eg) - I usually do them for free for campaigning groups whose aims I broadly agree with and I was offering to provide an adapted version for ManFriday but well, I'm sure you'll understand that I don't feel quite so content so to do now.

The way MF have acted quickly and openly since the leak is commendable and shows they are doing the right thing in the right way.

As an interested bystander I'd have to agree. Recently I do feel that there has been a bit of an effort to scare women into not organising or connecting with each other online. Don't think it's going to work, though it might encourage more action in RL too which won't be a bad thing.

The point here is not whether MF had a 'GDPR policy' or not - or do you actually mean privacy impact assessments and fair processing notices Revealing? but that an individual who had access to members' details chose to distribute that data in a way that did breach data protection legislation.
I hope those affected complain about the leaker to the ICO. That is where the mischief lies, not with MF.

Why and how was that person able to get that membership list?

I think this may be the source if the confusion.

You seem to be assuming ManFriday has constructed the membership list?

They didn't. Anyone in a FB group can see the other members of that group. Manfriday have no control over that.

revealingnothingfuckinpersonal have you any personal experience with adminning. FB groups?

revealing

They do not need a GDPR policy if they do not store personel data!!!
Why have a policy if you dont need one?

Also they do not need to report themselves to ico because the data was not theirs it was Facebooks data!!

Are you really sure you do this for a living?

Seems to be a bit of a tale of Mr Jeremy Fisher.

R0wan
I have sent you an unsolicted PM

Ballix do they not need a GDPR policy.

policies wouldn't have stopped the leak but they would have covered their ass with the ico and they would have been able to demonstrate that they had policies which had been breached - it would have put them in a much stronger position.

and now I really am going this is bloody ridiculous. I do this every fucking day for a living I write these policies - not because they will stop a data breach from a malicious person but because they demonstrate to the ico that the organisation concerned have taken data protection seriously and have done their best to make sure that people know what their legal responsibilities are.

Small activist and community groups were always going to be the biggest issue in GDPR especially when they grew organically and were in areas that were controversial - in terms of keeping data secure and with the potential for leaking of info online.

But whatever.

I agree materialist, this is no friend of MF

All this faux concern is just another excuse to stick the boot in. You weren't in the group reveal, what concern is it of yours if they were within a GPDR framework? Quite bizarre attempt at a kicking

I am out I have better to do than argue over this, the irony is I would have written a set of policies and procedures for ManFriday that would have been ironclad and covered their ass going forward - and that was what I meant when I said I would help.

That would have been pointless in this instance as the breach is under FB not MF so any GDPR policy they had would not make a blind bit of difference.

Going forward unless MF store and use people data outside of the FB platform they use they dont need a GDPR policy.

I think revealing has left the building...

Did you send your number to Sweary as an individual only or because you have the desire to get updates re manfriday

Both.

Look. If ManFriday are going to carry on after this, they need to wise the fuck up and put very much stronger policies in place. It's not whipping anything up to say that. If they had been wiser to start with, this would never have been able to happen and there is a degree of wilful naivety here that I find astonishing.

There is no naivety you just think they are a stupid bunch of women.

Policies would not have stopped this leak.
There is a policy in place for it under FB rules but the individual has broken those rules. Thats not the responsibility of MF.

As for being wiser how could they have stopped it? This person was an activist also. A big supporter there was no way of knowing they would act the way they have.

The way MF have acted quickly and openly since the leak is commendable and shows they are doing the right thing in the right way.

I am out I have better to do than argue over this, the irony is I would have written a set of policies and procedures for ManFriday that would have been ironclad and covered their ass going forward - and that was what I meant when I said I would help.

Now, after this, quite frankly they can shove it.

And there we go. It's all their fault for trusting that a woman wouldn't fuck the group over

Did you send your number to Sweary as an individual only or because you have the desire to get updates re manfriday?