Thread by @K_IngalaSmith

The excuse that clients’ sensitive personal data was publicly available but was intended only for trustees is in itself a massive red flag.
The occasions which trustees need any such data are rare. #Mermaids thetimes.co.uk/article/parent…

Did clients sign consent forms agreeing that their personal sensitive data could be shared with trustees?

Why doesn’t the charity have/use a secure encrypted email service for sharing client data on the occasions this is necessary?

There are occasions when it might be necessary for trustees to have access to personal sensitive data, for example if they are dealing with a complaint above CEO level, but that should be a selected small panel, not all trustees.

The parents in this paragraph reportedly questioning whether the emails should have been shared with trustees are absolutely right.

Honestly, this is a really serious breach, but in my opinion the explanation/excuse offered would in all likelihood be a serious breach in itself.

The new GDPR - General Data Protection Regulation- came in in May 2018.
Any organisation, charities included, would have been hard pressed to be unaware and should have been reviewing procedures in preparation. We all know this from the emails we got re mailing lists.

So it’s really is doubly shocking that this would happen now.