Transgender charity Mermaids has been fined for a personal data breach which led to sensitive information being put online. The Information Commissioner’s Office (ICO) has told the charity to pay £25,000 in relation to an internal email group it set up several years ago. The ICO found the group was set up with insufficiently secure settings and as a result, the personal information of 550 people - including names and email addresses - was searchable online. 24 of these included sensitive information, and for 15 it concerned special category data, with details over mental and physical health and sexual orientation exposed. Steve Eckersley, director of investigations at the ICO, said “The very nature of Mermaids’ work should have compelled the charity to impose stringent safeguards to protect the often vulnerable people it works with. Its failure to do so subjected the very people it was trying to help to potential damage and distress and possible prejudice, harassment or abuse.”