Data breaches by Mermaids exposed in the Times

Are there not any child protection guidelines that need following when it comes to paperwork or can Mermaids really do what it likes? I know has its own rules in so many other areas, but often, it's the paperwork that can be the undoing of many who think they are above the law.

Charities have to have Safeguarding policies.
For a children's charity, this would/should include policies re information sharing, confidentiality etc

Policies though are intended to representative of estabished practice which is subject to review & scrutiny.

Having a policy & getting people to sign it matters not a jot if the principles are not understood.

Mermaids do not understand Safeguarding.

There are multiple demonstrations of this.
(In fact every time the CEO Susie Green leverages suicide (contrary to Samaritans & all established good practice), this in itself should be considered clear evidence.

I have just seen this comment on twitter:

Jen @ Seinnean
Yet you seem to think that all data breaches mean a law has been broken. Surely you would have learned in your DP training that this actually isn't the case. Which is why investigations happen. Investigations determine if laws were broken, not the breach itself.

This is an interesting take.

In this case we have a charity which has:
Previously had an incident
Seemingly the breach is multi faceted (not keeping the data private in the first place and also sharing with people who didn't need to know details without consent)
The highly sensitive nature of the data
The amount of data over a long time period
Poor data protection training and understanding in the organisation.
A contemptuous attitude to the breach by trustees after the fact
A statement which was bollocks, followed by one which was slightly less bollocks. Both of which are inaccurate.
The fact data relates to children
The inadequate response and lack of taking it seriously by getting in an expert.
The fact that this is now on the Internet elsewhere which they are not informing those affected (I've just been told that Google search facility is making this easier to find as it's generating an auto correct algorithm).

The investigation of a data breech isn't so much about whether the law has been broken but about the seriousness of it, whether sufficient measures were in place to prevent it, the response to it and whether its worth taking action under the law as a result. The law has been broken by Mermaids own admission (cos if they didn't admit it, it would be an offence cos the times have got the evidence to prove they had been negligent).

Apparently none of these people are aware of the legal concept of 'in the public interest' either.

Can somebody who works in school safeguarding explain something to me?

I was under the impression that there are very strict rules reporting cases and that confidential information wouldn't be emailed across as standard to other parties. So telephone conversations, forms as attachments rather than content in the body of an email, maybe even encrypted emails ?

So (and sorry if this has been asked) but why were sensitive cases and personal information being emailed so freely, data fail aside?

I always think twice with work emails if there is anything remotely sensitive (I might ring the individual instead or have a meeting).

Are there not any child protection guidelines that need following when it comes to paperwork or can Mermaids really do what it likes? I know has its own rules in so many other areas, but often, it's the paperwork that can be the undoing of many who think they are above the law.

Hello, the ICO has received a data breach report from Mermaids UK and we will assess the information provided. Many thanks.

It needs to go to Children's Commissioner etc
This is a gross Safeguarding failure.

Mermaids do not understand Safeguarding.

Its not even about the data breach.
No CEO of a charity who is supporting children, vulnerable adults & their families would be sharing personal identifying emails with trustees from those they were supporting

Trustees who understand Safeguarding would also be mindful of this as there is an important balance between enabling Trustees to scrutinise & supervise the work by paid staff /volunteers and protecting service users.

There are established ethics with regards Confidentiality. These are part of Safeguarding frameworks.

Mermaids Charity do not understand or respect Safeguarding or Child Protection frameworks. Each failure & inappropriate response is indicative of this.

So, as of right now have they still put got an expert to sort it out yet? You can still find it? For fucks sake.

Question- do Mermaids own the platform they used for sharing this info? If not they're going to find the clean up process a little difficult...

They would have known from Thursday I reckon as that's usually when the Sundays plan their stories .

They didn't have a choice.

The Times were going to publish.

If having been informed of the breech they then failed to report themselves that would considered another breech in and of itself.

I'm glad they actually reported themselves, I was a little worried that they wouldn't

From an hour ago

ICO @ iconews
Hello, the ICO has received a data breach report from Mermaids UK and we will assess the information provided. Many thanks.

Plenty of time then.

Just to be clear, Mermaids reported the breach to the ICO on Friday. The story was published at 12.01 Sunday morning.

So they knew on Thursday/ Friday morning at a push.

I don’t think anyone posted anything here that identified any individuals, or any links or anything - some posts obliquely referenced where we had seen the data, which isn’t hard to find at all, and I speak as a non-techie frequently flummoxed by the interweb in general.

JessicaWakefield has included the relevant point from my post - that there are multiple emails from an EHRC solicitor apparently copying SG into email conversations she was having with trans youth/parents. SG then shared these with trustees (and the world). Emails contain names, addresses, workplace of parent, name of school etc. I feel there are questions about the appropriateness of the EHRC solicitor doing this as well as the SG/Mermaids end of the affair.

And to reiterate - this info is still freely available, online, now. This minute, just checked. Perhaps Mermaids should get an IT consultant to help them sort.....Oh.

That was my thinking OrchidInTheSun. There may have been nothing they could do if people already had copies. But they absolutely should have engaged a competent IT specialist to remove anything that could easily be found by all and sundry. The information has spread much further than it should have done if they had acted with due diligence as soon as the breach was reported.

I flicked briefly through Mermaids twitter and noticed that the early comments on their statements seemed to be from the anime mob rather from people who sounded like Mermaids families.

Yes, those defending Mermaids over this appear to be adults with a vested self interest rather than putting the interests of those directly affected first.

They had time to delete the cached pages between the time that the Sunday Times told them and the story breaking. They didn't, they just deleted the directory. They should have taken advice from an independent IT consultant that understands security breaches. They didn't.

facepalm

There is a reason internet security experts charge a lot.

I explained my earlier posing up thread.

This is awful for the children and families involved. Really awful.

However good will come of it if:

1. It causes people, including families and schools, to look more closely at Mermaids. Is this a professional organisation? Where does its expertise lie? Can it be trusted to put safeguarding at the centre of its operations?

I flicked briefly through Mermaids twitter and noticed that the early comments on their statements seemed to be from the anime mob rather from people who sounded like Mermaids families.

1. It causes outside regulatory organisations and sponsors to review relationships. This is a charity that advocates medicalising children. I hope the Sunday Times will use their unique insight to unpick what went wrong. Why was there a rapid change of approach? Why was this rapid change of approach so eagerly supported by funders, Stonewall, TV programme makers etc? Why were medics ignored? What lessons might be learned?

What has happened is awful, but hopefully it will be the big bang that blows all this suicide hocus-pocus and pink brain jelly baby stuff right up. So that dysphoric children are treated sensitively but conservatively so they preserve their open futures.

Susie Green needs to resign. And any trustees implicated should stand down. They cannot minimise this. It is shocking.

They are still failing to realise the severity of this

They know but they don't care, this archive was basically set up so trustees could read intimate details about these children.

They had time to delete the cached pages between the time that the Sunday Times told them and the story breaking. They didn't, they just deleted the directory. They should have taken advice from an independent IT consultant that understands security breaches. They didn't.

They are still failing to realise the severity of this

But people didn’t start archiving it until it became widely known it was available via the article surely? Were people archiving it beforehand? In that case, fair enough, but the Times told them, gave them a chance to fix it, then publish the story, and stuff was still available via the same search terms. Couldn’t that have been prevented, or am I missing something?

The question here comes down to when the times told Mermaids to a certain degree and whether they gave 'sufficient time between this point and publication to resolve the matter'. I'm sure this will become a point of contention on social media... But the bottom line is that it a) should never have happened and Mermaids have legal responsibility for that information b) no one can tell who accessed that information and stored it and when because of how long it's been public before the times reported it.

But people didn’t start archiving it until it became widely known it was available via the article surely? Were people archiving it beforehand?

Probably yes. It was something you could easily innocently stumble across.

stuff was still available via the same search terms. Couldn’t that have been prevented

It could have if Mermaids had been competent in the first place. The problem is once information is available openly on the internet every search engine will see the data and list it, and cache it.

Mermaids could have asked Google to remove it completely if there was a reason, legally or morally to do so. I suggest it was possible to remove it so that it wasn’t available to archive.

Much as I hate to say it, that isn't something Mermaids could have done. They have presumably fixed the original leak, but all that data is out now in various locations and there is no way to magically recall it.

But people didn’t start archiving it until it became widely known it was available via the article surely? Were people archiving it beforehand? In that case, fair enough, but the Times told them, gave them a chance to fix it, then publish the story, and stuff was still available via the same search terms. Couldn’t that have been prevented, or am I missing something?

Yes, I think that's the right thing to do.