proudestmumm "Right so. You actually think that because ManFriday, which is a campaigning group, was primarily set up on FB, the rules of GDPR don't apply in the event of a data breach?
Or am I reading this wrong?"
No, and yes.
Let me try again.
If you sign up for fb you accept their t&c and fb is the primary data controller and processor wrt to data you give them.
Admins of fb groups are not responsible for content in their groups or data of group members in terms of GDPR.
Part of the t&c say things to the effect that they (fb) can share your data with partners in some circs, and that everything you post belongs to them.
It also says it's down to you to keep your privacy settings how you want them, and that the only bit that HAS to be public is your name, and that certain other parts of your profile are public if you fill them in - e.g. Workplace, university, location etc.
Groups are not private conclaves within fb, they are just a mechanism for sharing certain posts amongst a group of users selected or monitored by group admins. There is nothing in the t&c or community guidelines that I can find that says you cannot manually write a list of who is in the group by their fb usernames and share that list outside the group, so the person who shared the list does not seem to have broken any fb t&c.
Fb is not going to regard the the sharing of a list of the public profile info of usernames of fb users belonging to a certain group as a data breach. Nor is the ICO going to give a hoot about the person who chose to share the list of usernames that are members of an fb group.
What it boils down to is that being a closed or secret fb group gives an illusion of exclusivity and privacy, but in reality, stuff you put in a group, or the fact of your username belonging in that group, is just as much FB property as everything else in there, and you signed away your right to privacy on the public parts of your profile when you accepted the t&c, whether you read them or not, just like you signed away exclusive ownership of images you share etc etc.
Fb is not a good place to hold conversations you think should remain private. It's a bit like mn in that respect. Everything here can end up in the DM or anywhere else mn chooses to permit to share it, complete with any publicly available info you include in your profile.
If that sort of thing bothers you then you really should read the t&c when you sign up to places. Luckily, GDPR does actually encourage companies like mn and fb to do betterment at making their t&c findable, readable and clear, so that's good. Fb in particular have done a massive overhaul on their setup and it's way more readable now.
If it's a group whose membership must remain secret, don't host the group on Facebook, because there is no obligation on the platform or any individual member to not disclose the usernames of other members of the group. It's the nature of the platform, in its DNA, that people can find each other and view one another's public profiles.
Anyway, by all means go ahead and report their asses to the ICO. I will be happy to stand corrected if it turns out I'm wrong. I'm just trying to save your wasting your time on a massive red herring that will get you nowhere.
GDPR is a piece of legislation that has been whipped up by the media, distorted, misunderstood, and used by unscrupulous lawyers to take advantage of less than savvy businesses, including major players who should know better. It doesn't surprise me to see to bandied around here as the panacea to all data ills. It's a lot like the millions of times organisations have said they couldn't do whatever because data protection, which was frequently utter bollocks too.
That was long.... I'm sure it was utterly fascinating though. I don't think I've got the energy to try again if it's still not getting across, so I'll leave it there. No one will be harmed if you go on and do all the reporting you like, so honestly I'm not even sure why I'm troubling to save you the bother. Never mind, I've typed it all out so might as well post. Go knock yourselves out and report away. Let me know how you get on if you get a chance.