> On 15 August 2016, which is the date on which the email group of relevance to the contraventions set out in this notice was created, the Chief Executive Officer ("the CEO") was at that date the only paid staff member at Mermaids. On 14 June 2019, Mermaids were notified by a service user of the charity that internal emails containing personal data were publicly available online. Mermaids contacted the Commissioner later that day to report the concerns. On 17 June 2019, the CEO telephoned the Commissioner to update her and sent a follow up email detailing the remedial steps which Mermaids had taken

£21,000

> At 14: 22 on 6 September 2019 a member of staff in the - used Microsoft Outlook to generate an email communication which was initially sent to a total of 1,781 GIC patients. The email was sent in two batches comprising 912 and 869 email addresses respectively. In both batches the email addresses were copied from the output report and entered into the "To" field instead of the "Blind carbon copy" ("Bee") field. The recipients of each email could therefore see the email addresses of the other recipients of that email. Four of the emails were returned as undeliverable and so potentially 1,777 emails were delivered and opened

£92,000

I mean, they did accidentally dox their clients which is in scope for GDPR enforcement, and they are the 2nd and 3rd lowest fines (likely due to a low level of intentionality and resources), with the only lower fine going to a HIV charity.

Honestly this seems fine.