Been watching this thread for a while, had concerns about Depher for years after seeing their shenanigans on Twitter.
Since James is clearly reading Tattle and because I've had my head in Freedom of Information stuff today, I'd like to reinforce one point:
A charity or organisation should NEVER reveal personal identifying information about individuals they serve. It breaks the conditions of GDPR to post photographs without specific consent of the people involved (preferably in writing). Nor should you publish details that may be traceable back to an individual -- this would include specific health conditions, family circumstances, home or finances.
So all those social media posts posing people who might be vulnerable service users of Depher, or even pics that may give clues as to people's identities or place of abode, are breaking GDPR protocols. You also cannot post letters with identifying names and places in the text, even if you've redacted the sender's address.
It's breaking privacy law to publish all these details, which Depher is doing daily on its social media channels.
It's also morally repugnant to be using these images and emotive language to raise money from the public, especially when it appears there's very little accompanying transparency about your income and accounts (by which I mean audited information by a third party, not screengrabs and social media posts).
---
Been watching this thread for a while, had concerns about Depher for years after seeing their shenanigans on Twitter.
Since James is clearly reading Tattle and because I've had my head in Freedom of Information stuff today, I'd like to reinforce one point:
A charity or organisation should NEVER reveal personal identifying information about individuals they serve. It breaks the conditions of GDPR to post photographs without specific consent of the people involved (preferably in writing). Nor should you publish details that may be traceable back to an individual -- this would include specific health conditions, family circumstances, home or finances.
So all those social media posts posing people who might be vulnerable service users of Depher, or even pics that may give clues as to people's identities or place of abode, are breaking GDPR protocols. You also cannot post letters with identifying names and places in the text, even if you've redacted the sender's address.
It's breaking privacy law to publish all these details, which Depher is doing daily on its social media channels.
It's also morally repugnant to be using these images and emotive language to raise money from the public, especially when it appears there's very little accompanying transparency about your income and accounts (by which I mean audited information by a third party, not screengrabs and social media posts).
Quoting myself to add:
Any one of Depher's clients (whether or not they paid for the services provided) has the right under GDPR to request a detailed report on what information Depher holds on them, how this is managed, how secure it is and whether or not it is used for any other purposes than the fulfillment of a job. They also have the right to lodge a complaint if they believe their privacy has been compromised.
Any organisation that breaks the protocols of GDPR is liable to a fine. So, James, privacy is serious and you are breaking privacy laws with your ongoing social media posts. You can verify this through the Information Commission Office -- it's all online and you can call their helpline for advice.