Enforcement · Information Commissioner (ICO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Mermaids: Insufficient technical and organisational measures to ensure information security

€29,000 Fine
Mermaids
UNITED KINGDOM
Art. 5 GDPR Art. 32 GDPR
Encryption Security Data Breaches Privacy by Design & Default Pseudonymization Personal Data Human Resources
Jul 5, 2021 Source

How it connects

Related across sources

Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance Guidelines 9/2022 on personal data breach notification under GDPR EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB News De Deense beschermingsautoriteit (SA) heeft verklaard dat het gebruik van Google Analytics onrechtmatig is zonder aanvullende maatregelen. Datatilsynet Guidance Guidelines 3/2019 on processing of personal data through video devices EDPB Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review

Full text

The ICO has fined transgender charity Mermaids EUR 29,000 for failing to protect the personal data of its users, in breach of Art. 5 (1) f) UK GPDR and Art. 32 (1), (2) UK GDPR. The ICO conducted an investigation after it received a report of a data breach relating to an internal email group. During the investigation, the ICO found that the group was created with insufficiently secure settings, resulting in approximately 780 pages of confidential emails being viewable online for nearly three years. This resulted in personal information, such as names and email addresses, of 550 people being online. The ICO concludes that Mermaids should have restricted access to its email group and could have considered pseudonymization or encryption to provide additional protection for the personal data. Organizations responsible for personal data must ensure that they take the appropriate technical and organizational measures to ensure the security of personal data.

Industry: Individuals and Private Associations

Original document at the source ico.org.uk

Similar Content