NYAS (National Youth Advocacy Service)
What did the National Youth Advocacy Service get wrong?
They offer pages for children to understand advocacy like Get Support / Young people / Advocacy
This page included a video for children to help them understand advocacy.
The video content was hosted using YouTube embeds and therefore directing troubled children to the online harms risks of YouTube.
The embeds were also not using YouTube's privacy enhanced mode. Thus, from a privacy perspective this was a worse situation than the Childline situation currently.
As a result of this, identifiable data was being sent to YouTube, without a child's consent, from the NYAS website, that the child is seeking information to help them understand Advocacy. This is not a typical situation for a child and not data, about them, that should be given to an advertising and content recommendation system the children would then be vulnerable to.
Is it fixed?
It looks better
The YouTube video has been removed from the page, so the site appears to be safer and protects kids data data better
However, the charity are yet to respond with their actions to tidy up the data unlawfully collected or confirm whether all instances of YouTube have been removed from their stie.
Hopefully, their response will clarify this and they will report the breach to their audience.
Raising the complaint
11th January 2023: The charity and ICO were informed of the data breach and safeguarding failure.
The complaint included an
Their Response
12th January 2023
Thank you for reporting this potential data breach and for sharing your concerns.
I would like to reassure you that we do take data protection concerns very seriously particularly where vulnerable children and young people are Involved.
Your complaint will be investigated and we will revert to you in due course.