What were the charity and trust getting wrong?
This may involve two organisations: Great Ormond Street Hospital for Children NHS Foundation Trust and Great Ormond Street Hospital Children's Charity
The trust offers advice for patients such as this page: Before you come to GOSH.
The charity offers play pages for children, targetting certain conditions, such as this one for anxiety, isolation, sadness and worrying: Meet the Peppy Pals
Some of these pages (like the two above), included videos.
The video content is hosted using YouTube embeds and therefore directing the children to the online harms risks of YouTube.
The embeds were not using YouTube's privacy enhanced mode. Thus, from a privacy perspective this was a worse situation than the Childline situation currently.
As a result of this, identifiable data was being sent to YouTube revealing that a child is involved in hospital care or that a child has a health condition.
Furthermore, the YouTube embed asks the child to "Watch on youtube.com" when they hover over the YouTube icon and the video title takes the child to YouTube. Thus the embed the trust and charity chose, is encouraging the kids to go to YouTube, where they are then at risk to the online harms risks outlined on the NSPCC article on this site.
Is it all fixed?
When last checked, not in the charities site, but it looks like the YouTube video the trust were informed of has been removed.
Raising the complaint
6th January 2023, the charity, trust and the ICO received a complaint detailing how GOSH websites were sharing data with YouTube.
Both organisations responded the same day to acknowledge receipt and advise they would investigate.
Last checked, I was still awaiting a response although it is good to see the trust have removed YouTube on the page.