Transgender Rights Charity Mermaids fined £25,000 by the ICO for data protection breaches

It is unfortunate at times that some charities which do the most sensitive of work also hold the most sensitive data. It makes data protection compliance all the more critical. Unfortunately, the transgender rights charity Mermaids has fallen afoul of data protection laws in the creation of a email group that was not sufficiently annexed or encrypted to protect the data it contained.

The result was that the 780 email pages were identifiable online over a period of three years. This led to the personal information of 550 people to be searchable online. Furthermore. the personal data of 24 of those people revealed how they were coping and feeling. Finally, for a further 15 classified as special category data as mental and physical health and sexual orientation were exposed.

Steve Eckersley, Director of Investigations at the ICO said:

“The very nature of Mermaids’ work should have compelled the charity to impose stringent safeguards to protect the often vulnerable people it works with. Its failure to do so subjected the very people it was trying to help to potential damage and distress and possible prejudice, harassment or abuse.

“As an established charity, Mermaids should have known the importance of keeping personal data secure and, whilst we acknowledge the important work that charities undertake, they cannot be exempt from the law.”

This serves a warning call for charities who process sensitive personal data – under the GDPR and the framework of self reporting you need to have appropriate technical measures in place. Failure to do so puts users data at risk and leaves them vulnerable. Mermaids penalty was imposed for the data being at risk for the period of 25 May 2018 to 14 June 2019.

It is notable that Mermaids data protection policies and procedures were not updated to reflect GDPR standards. Post the implementation of the Data Protection Act 2018 data protection practices are taking increasing importance and a robust review with practical changes to data harvesting, management, retention and rights handling is now a necessity.

Duchess of Sussex, Meghan Markle successful in privacy claim against the Mail on Sunday

Meghan Markle has been successful in her privacy claim against the Mail on Sunday regarding the publication of excerpts of the contents of a private letter to her father.

The Duchess’ request for summary judgment on the parts of the claim concerning privacy were granted by Justice Warby.

In finding that the statement of case had no reasonable grounds for defending the claim Warby J considered whether the defence stated has an defence had the ability to offer a defence to the claim of misuse of private information. Further,
“(i) at the time of its publication, the claimant had a reasonable expectation of privacy in respect of the contents of the Letter, and

(ii) this being the case, and
applying the requisite balancing exercise, the defendant has failed to discharge the burden which rests upon it to advance a viable justification for interfering with that
right.” at p.35

Question (i) – A reasonable expectation of privacy

Justice Warby considered whether the Defence set out and had a reasonable prospect of advancing that the claimant no expectation of privacy in the information at issue. Also whether there was an realistic prospect of success of the defendant defending this at trail. Warby considered the response to be no on both counts.

He strictly applied the criteria found in the Murray case:

“(1) The claimant was a prominent member of the Royal Family, and in that sense a public figure, who had a high public profile, and about whom much had been and continued to be written and published; this is an important feature of the background and the circumstances but

(2) the nature of the “activity” in which she had engaged was not an aspect of her public role or functions; she was communicating to
her father about his behaviour, its impact on her, her feelings about it, and her wishes
for the future; and

(3) she was doing this in a letter sent to him alone, privately, by means of a courier service.

(4) The “intrusion” involved the publication of much if not most of the information in the Letter by way of sensational revelations over four pages of a popular newspaper and online, to a very large readership; and that, in broad terms, was the purpose of the “intrusion”.

(5) There was no consent, and it is beyond dispute that this was known to or could have been inferred by Mr Markle and the defendant.

(6) The unwanted disclosure was likely to cause the claimant at least some distress,
especially as it was done with the co-operation of her father, and in the context of a detailed and critical response by him to the content of the Letter.

(7) The information
was given to the defendant by the claimant’s father.” at p.69

Question (ii) – the balancing exercise

Warby J next turned to the fact of whether the publication could be proportionate in pursuit of
the legitimate aim of protecting the rights of others? Is the interference with freedom
of expression that would be represented by a finding of liability necessary and
proportionate in pursuit of the legitimate aim of protecting the rights of the claimant?

In concluding that it could not significant weight was given to Ms Markle’s status as a public figure. It was considered a theme of the Defendant’s arguements that the Duchess had sought to manipulate her image to be seen favourably. In this case an arguement that publication was preventing the public from being misled- a weighty arguement indeed- failed.

Warby J however considered the case “legally untenable or flimsy at best.” Concluding as two part (ii):

“The claimant had a reasonable expectation that the contents of the Letter would remain
private. The Mail Articles interfered with that reasonable expectation. The only tenable justification for any such interference was to correct some inaccuracies about the Letter contained in the People Article. On an objective review of the Articles in the light of the surrounding circumstances, the inescapable conclusion is that, save to the very limited extent I have identified, the disclosures made were not a necessary or proportionate means of serving that purpose. For the most part they did not serve that purpose at all. Taken as a whole the disclosures were manifestly excessive and hence unlawful. There is no prospect that a different judgment would be reached after a trial. The interference with freedom of expression which those conclusions represent is a necessary and proportionate means of pursuing the legitimate aim of protecting the claimant’s privacy.” at p. 128

The copyright infringement questions were partially disposed off. The remaining copyright issues were left to be considered following the directions given at the next hearing of 2 March 2021.

Top 5 data breach fines since the implementation of the GDPR

Given the growing enforcement of the General Data Protection Regulation and the increased fine limits these laws impose we bring you our analysis of the 5 highest fines, along with the comments from the data protection regulators that issued them. These fines together showcase the practical implications of the new regulation and how some of the biggest companies fell foul of sanctions. Analysis is given as at 24 December 2020.

Continue reading

Tackling hate speech- Intersecting approaches and the Raheem Stirling case

The case of footballer Raheem Stirling provides an avenue into the oft-overlooked issue of hate speech prevention and deterrence. The adequacy of English law in tackling hate speech, a nuanced and increasingly difficult to isolate issue.  This is due to an instance of hate speech having the potential to cover a wide variety of legal actions and regulations. This in and of itself can be problematic; actions may not quite fit the scenario to which they apply or require careful adherence and scrutiny to ensure a just outcome. Continue reading

Citation: Drone hysteria and the serial privacy invaders of the British Press – Hugh Tomlinson QC

An excellent post from the INFORRM Blog’s Hugh Tomlinson QC analysing the Gatwick incident involving drone use and the privacy issues arising from press reporting and investigations by the Sussex Police.

Inforrm's Blog

The news last week was dominated by the “Gatwick drones” with the country’s second busiest airport being closed three times in three days and 140,000 passengers being stranded.  On Friday 21 December 2018 a local couple were arrestedfollowing a tip off“. 

View original post 811 more words