WIBU to ask guide leader to change the way she emails?

[SockYarn]

DD goes to guides. Or rather doesn't go to Guides at the moment because of Covid. The guide leader has been trying to keep things going by emailing out weekly packs, and setting up Zoom meetings at notmal guide times. All great.

But when she emails, she puts every parent's email address in the "to" field. So I can see everyone's email addresses, and everyone can see mine. Most of the emails are very identifiable as most people use the firstname.surname@ emailprovider.com format with underscores or numbers or something.

I'm not that happy about it, but on the other hand I really appreciate the unpaid volunteering she does for the guides and how hard she's working to keep it going when they can't have proper meetings.

Guider here
We have been told time and time again not to do this

I would tell her, politely of course.mind you if she is anything like as stressed as I am at the moment she might not take it too well !!

Don't mess about, the next upset person might not be as nice as you. Contact her as quickly as you can and tell her that she is in breach of GDPR and needs to make sure she uses bc in future. Do her a favour.

she might not have the time/skill to bcc.

Then she needs to learn.

(Time it takes to Bcc: instead of To: = No time)

I was in a similar situation. I just emailed asking the person to use the bcc field in future, and mentioned that for data protection reasons they shouldn't be sharing people's private email addresses. They did that from then on, so all good.

Our teacher did this today- and even worse, used an email thread from a parent regarding issues with her child’s work and all the parents can now see that whole thread as well as each other’s email addresses 😬🙈

Our scout leaders have done similar except it’s on WhatsApp. All the parents phone numbers are visible to everyone. I’m not altogether comfortable with it but I don’t want to be the knob who complains.

Fuck all point in having rights if you can't - or feel you can't enforce them.

She's in breach of GDPR and should be aware of this so definitely not unreasonable. She should be using bcc or a distribution list that people can't see the individual email addresses on. I think you just need to be careful how you word the email to her!

I’m a Guide leader and she definitely should be using BCC for parent emails

I put the leaders in as CC (with their permission) and BCC all the parents.

If it’s a one off and she normally does use BCC then I’d be inclined to give her a break and let it go on this occasion. Everyone makes mistakes.

If it’s the normal way she sends them then I would suggest a polite, calm response asking if she would mind using BCC in the future as you’re concerned about your email addrsss being shared. Ideally with a thank you for all you’re doing included as well!

It's a balance though, isn't it. I have been that volunteer who is run ragged with lots of stuff going on, and trying my very best. You never get a thank you, just people moaning about things.

Whats App is a bit different - you don't usually get your phone hacked or spammed in the same way.

I would just do a friendly email something along the lines of

'thanks for sending the info. Just wanted to let you know that you'd used CC meaning all email addresses were visible, rather than BCC as required by the data protection legislation . We are looking forward to the activities.

She may well think that using CC instead of to hides the addresses.

As PPs have said, it is against GDPR and GG policy. Out of all the aggro in sending an email out after logging into GO, downloading the email contacts and pasting them into the email account, picking the BCC box instead of the to box is pretty darn simple.

she might not have the time/skill to bcc.

Then she shouldn't volunteer any more, because she doesn't have the time/skills to do the job without breaking the law. It's a requirement, simple as - and hardly a difficult one to follow.

Speaking as a guided this is breaching all rules.

It could be a simple mistake as happens to everyone sometimes. I would address it. We don't bite!

But yes very wrong and goes against what girlguiding has been told

Oh goodness I’d hate this. I am a volunteer in a similar field and we’ve spent soul-destroying months making sure we don’t foul up from a GDPR perspective. Apart from anything else, there’s always some twat that wants your email address for their Tupperware party type spam.

Report her to Girl Guiding and say she is regularly breeching GDPR.

You don't know what else she is doing it with and she needs proper training.

This is a safeguarding issue.

It's a balance though, isn't it. I have been that volunteer who is run ragged with lots of stuff going on, and trying my very best. You never get a thank you, just people moaning about things.

However that isn't a valid defence in court. We aren't talking about little courtesies here. We are talking about the right of every parent in the group to have their personal data protected to a standard mandated by law.

(I know there is a massive operation to try and create a "leave them alone they are doing their best" culture in the media for all sorts of reasons. But that will fall apart very rapidly if it ever reaches the astringent atmosphere of the courts.)

There's also a follow up question of what else the leader might not be up to speed on that impinges on the well being of the group. I know I'd be asking it.

It’s a huge GDPR issue. I volunteer for two “club” type things. The fact I am not getting paid doesn’t mean I can go around committing GDPR breaches.

How is it a safeguarding issue? It's my email, not DD's. The guide leader never emails the girls direct, it's always filtered through parents.

GDPR issue probably, but safeguarding?

I would message her and say something like:

Dear Guider,

I really appreciate all you are doing to keep the pack going, etc.

I just wanted to point out something as I thought it had the potential cause issues for you. I noticed that in your last email we could see everyone's email addresses, as they were in 'to' rather than 'bcc'. I don't know whether you were already aware of this (if so, please ignore me!) but just in case you weren't I thought I would let you know!

Thanks,
SockYarn

Don't mention GDPR or Data Breach as then she is obliged to report it to the data officer, which could cause more stress!

She probably hasn't realised she has done it. My choir leader accidentally did it once and was mortified when he realised. I have to admit I only realised a year or so ago that you could do it.

As a former Brownie leader of 20 odd years, the Guider SHOULD be blind copying all parents into emails. It was clearly stated in Guiding handouts when the new GDPR regulations came into force.

@SockYarn it could be in very specific circumstances.

If you just say to her in just noticed that I can see everyone's emails. I wondered if they could be blind copied in future. It's really not difficult

Definitely breach of GDPR... Couch it in a way that you're just saying it so she doesn't get in trouble etc.

Definitely tell her. I'm a Guide leader and we've been being told to BCC group emails since long before GDPR.

I'm not a Guider but I volunteer in another youth organisation. We are told that we absolutely must use BCC for all mass emails. Whilst most of our families know each other and wouldn't be particularly bothered if we shared their email addresses, we have a couple of families who could come to harm if their contact details got into the public domain. But that's irrelevant really - people have a right to privacy, whether they have what seems like a "good reason" or not. Organisations that hold identifiable data have an obligation to maintain privacy and whilst the Guider almost certainly means no harm, she is breaking the law and I think you should gently point this out before any harm can come of it.