> This penalty has been issued because of contraventions by Mermaids of Articles 5(1)(f) and 32(1) and (2) of the GDPR in that during the period of 25 May 2018 to 14 June 2019 Mermaids failed to implement an appropriate level of organisational and technical security to its internal email systems, which resulted in documents or emails containing personal data, including in some cases relating to children and / or including in some cases special category data, being searchable and viewable online by third parties through internet search engine results.

A fine for this seems reasonable. Data on sexuality and medical history is protected beyond the normal level for personal data.