Data breaches by Mermaids exposed in the Times

Theres been a lot of quesions as to why emails were passed on to the trustees. I can think of two reasons.

1. To demonstrate how bad been trans is/ what a big help mermaids is. Nothing like hearing you're wonderful and life changing to quash fears about what you're doing. I may be slightly cynical here. Basically for legitimate purposes to help guide future activities. Obviously this should have been made anonymous and without identifying details. There is a strong argument for just using quotes but seeing a quote in context can be more useful. I imagine this will he the defence used.

2. I don't want to be deleted so I'll let you insert your own reason here.

Is it possible they aren't listed & have their identity protected?

I had believed this wasn't possible but have a memory that MESMAC (which is based nearby) had unlisted trustees.

Which would seem a serious issue to me if true.

Is there a minimum (and maximum) recommended number of trustees for a charity? 3 seems a rather small number?
I would have thought the Lottery fund would take a long look at the number and quality of trustees.

Wait, so they’ve gone from 13 trustees to 3 in the space of 3 years? Despite massively increased funding

It's intriguing isn't.it.

beta.charitycommission.gov.uk/charity-details/?regid=1160575&subid=0

2016: 13 trustees (3 anonymous)
2017: 14 trustees (3 anonymous)(4 changes)
2018: 7 trustees (3 changes)

From website:

2019: 3 (1 change)

Also from website:

SG trustee for 10 years, chair for 3, CEO since Jan 2016. SG first paid member of staff.

Thanks. That makes more sense. I looked at the Mermaids website but it wasn't clear.

The Mermaids website is confusing and suggests SG is a trustee. But from memory Charities Commission docs have her standing down when she became CEO.

The mystery is why so many stood down in the last couple of years. Concerns about liability? (I have no idea.)

SG I believe may be on the board of trustees in her capacity as CEO. You don't have to have the title trustee to have the role and responsibilities of a trustee.

The parents would have to be pushed a hell of a way to sue. They are very invested in this all being hunky dory because of the path they have chosen for their child. To admit that this is in any way wrong is admitting that they have messed up. They just won’t do that - this is exactly why this exists.

And I think someone mentioned upthread that SG is also a trustee.

I believe that SG was formerly a trustee, but is no longer.

And I think someone mentioned upthread that SG is also a trustee.

I'm not familiar with the corporate world, but I'm surprised that someone can be both CEO and a trustee. I thought trustees were there to oversee an organisation and its management. Being CEO and a trustee feels like a conflict of interest.

But I admit I know nothing.

Are there really only three trustees? Seems like not enough.

From 2017 (under the less strict DPA):

ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/04/ico-fines-eleven-more-charities/

Information Commissioner Elizabeth Denham said:
“Millions of people will have been affected by these charities’ contravention of the law. They will be upset to learn the way their personal information has been analysed and shared by charities they trusted with their details and their donations.

“No charity wants to alienate their donors. And we acknowledge the role charities play in the fabric of British society. But charities must follow the law.”

And

“These fines draw a line under what has been a complex investigation into the way some charities have handled personal information. While we will continue to educate and support charities, we have been clear that what we now want, and expect, is for charities to follow the law.”

The charities in question were:
The International Fund for Animal Welfare,
Cancer Support UK, Cancer Research UK, The Guide Dogs for the Blind Association, Macmillan Cancer Support, The Royal British Legion, The National Society for the Prevention of Cruelty to Children, Great Ormond Street Hospital Children’s Charity,
WWF-UK, Battersea Dogs’ and Cats’ Home,
Oxfam.

If I was a parent I'd be sueing them, they have put a lot of families in danger, but that won't happen with their followers.

If I were one of the parents whose correspondence was not adequately protected (and the confidential data is still online - FFS why isn’t Mermaids throwing everything at a clean-up) I would be suing their ass off. It is shocking what is now in the public domain.

pom, just to pick up on your furry references. The furry community has a lot of minor attracted persons.

Remember that the Challenor case (in which David Challenor was sentenced to 23 years for torturing and raping a 10 year old girl in his attic) featured the furry community. Challenor was also known as Baloo. And there was also adult baby stuff.

This was the scandal last year in the Green Party for anyone who doesn't know. Challenor got away with a lot (including harassing a green party member through the courts because he wanted to silence him). The Green Party assisted Challenor with this. The transgender shield of his child placed them above scrutiny.

^www.mermaidsuk.org.uk/privacy-policy-and-cookies.html^ (archive.li/ZBQzY)

"if we have no contact with you for two years, we will contact you to confirm whether you wish to remain a member. If you do not wish to remain a member or we do not receive a response from you, we will delete your data."

"After you have terminated your use of Mermaids services, we will store your information in an aggregated and anonymised format"

I wonder if they have been following their own policy...

One of those tweet replies refers to a new Comms Manager only in post since Feb. They done an exceptional job of staying out of the spotlight!

Mr Gilligan is saying the statement has changed again, this time to admit personal details were compromised.

And have been shared all over the world on somewhat dodgy websites that really do have a lot of transphobia on. Have they mentioned that bit?

Do you think the penny is dropping at Mermaids yet?

I love the reply to Gilligan's tweet and his quip back about his article.

I'd say it's unbelievable but it really isn't.
It's lie and when that doesn't work change the story.

Mr Gilligan is saying the statement has changed again, this time to admit personal details were compromised.

twitter.com/mragilligan/status/1140689310435483649?s=19

So all the trustees and management team? Or they could decide to throw one of them under the bus in a big way in theory?

The Lloyds guy looks like his job description might cover that side of things. He could lose his job at Lloyds too I suspect.

www.mermaidsuk.org.uk/mermaids-trustees.html
Trustees

I also just noticed this from that page:

In January 2016 we took on our first member of paid staff when we employed a CEO. This was followed in September 2016 with the addition of 2 part time Helpline posts, having being awarded a grant by Children in Need to develop and strengthen our core services, the helpline and email support provision

The fucking irony in that...

I think a data controller can be the incorporated body itself, so not necessarily a named person or persons. But I could be wrong.

I also note from that website:

The commission can take trustees to court to recover funds lost to their charity as a result of a breach of trust.

You can also be liable to another person if your charity isn’t a charitable company or CIO. If you enter into contracts to provide services or employ staff, you could be personally liable for any debts your charity can’t pay from its money or assets.

This means your charity’s creditors can sue the trustees personally to recover money they’re owed, even if there hasn’t been a breach of trust. Trustees who have acted properly can be reimbursed from charity funds, providing the charity can afford to repay them.

Oh. If I'm reading that right...

The ICO could slap a massive fine on Mermaids... And the charity could potentially sue a trustee for their lack of governance to recover the money, if they could demonstrate they acted unlawfully or negligently.

Also trustees don't have to be called trustees specifically:
They may be called trustees, the board, the management committee, governors, directors or something else.

Oh.

Who is Mermaids data controller? Are they named?