The Whistleblower Page

Home

Sun, 09 Nov 2025 19:33:21 +0000

Index

Essentials in Summary

Information

Contact Me

PGP & SHA-512 Key

Updated ZIP File Documents

Canary

Contact Me

Sat, 06 Dec 2025 16:36:42 +0000

If you wish to contact me, my email is: enquiries@sameula.net (I do not use any other email and I may not reply on other platforms)

Due to the volume and existing commitments, I may not be able to reply individually, please do not be disheartened if this is the case. You are more than welcome to send follow-ups in any case.
For accredited journalists or regulators, please clearly identify your organisation and role in your email.
I do not have a contact number to provide. All phone calls (where necessary) are done via Signal, and primarily will be in writing.

Information Sharing

If you have relevant information about The Scout Association, you may send it to me. I will prioritise submitting credible, material information to regulators where appropriate.

Privacy and safety

I will take reasonable steps to protect identities and minimise personal data. I cannot guarantee confidentiality or anonymity, and I may be required to disclose information under law or regulatory process.

Do not send

Rumours, vendettas, or unverifiable claims
Safeguarding information or details that identify a child/vulnerable person
Personal data (names, addresses, phone numbers, emails, screenshots with identifiers)
Anything obtained unlawfully, by hacking, or in breach of legal duties

If you accidentally include identifiers, I will redact or delete the message and use only non-identifying summaries where necessary.

Publication

I will not publish raw materials. If publication is ever considered in the public interest, I will use sanitised extracts only and will obtain explicit written consent for the exact redacted text to be published.

Secure communication

If you prefer encrypted communication, you can use my PGP key.

If you choose to use privacy tools (e.g., a separate email address), that is your decision.

PGP & SHA-512 Key

Sun, 09 Nov 2025 20:22:20 +0000

This key is used to verify that I have made an official statement:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaRD3ThYJKwYBBAHaRw8BAQdAnCTQ+jXaqzjWEEHUzHRdNiQiMqPERn4S1P3V

t5Mo0lG0J01vaGFtbWVkIFNhbWV1bCBBaG1lZCA8bXNhQHNhbWV1bGEubmV0PoiZ

BBMWCgBBFiEEnaL1Jc58XvuVOq52yrnL7aQWpO0FAmkQ904CGwMFCREy3PIFCwkI

BwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQyrnL7aQWpO2KsQD9Eb1UtHXsgigB

2FDeBK6/yZswB44URjYbLaEhMoveF38A/10DF+QQj5xOtSOj05PXEmQjoHxDx5kF

tkzcqcpSxRcDuDgEaRD3ThIKKwYBBAGXVQEFAQEHQBeI2/eA1G09jZ6gtYLpvA4C

iH4vR4kBK97Y1vdA3odrAwEIB4h+BBgWCgAmFiEEnaL1Jc58XvuVOq52yrnL7aQW

pO0FAmkQ904CGwwFCREy3PIACgkQyrnL7aQWpO3zqgEA5h+W18GUaeqojffViCu/

mKcoSyEJRTeydmVwIEUlumoBAPqGNFM9nociZwOIZvWXUQJbPA+rgTpKuA1UfFaT

72kP

=RQl6

-----END PGP PUBLIC KEY BLOCK-----

This is the SHA-512 for the ZIP file to ensure it has not been modified (as of 16/03/2026):

"0e2217d7fc12ddb7ff3f10faba7439c978a47f4224751208676c25c1a179600c30980e687fac27822acf98f6d08ff5550a330b49b42b9aa76e4c9c6d290cf0bc"

The Essentials in Summary

Sun, 09 Nov 2025 23:46:59 +0000

Between August and November 2025, The Scout Association, one of the UK’s largest youth charities, is alleged to have had multiple compliance and governance concerns arise, which I have reported to the Charity Commission and the Information Commissioner’s Office (ICO) for review. These concerns may involve trustees, senior leaders, and multiple departments. This site sets out my personal account and analysis as a whistleblower, based on contemporaneous emails, screenshots, and documents in the ZIP archive. Where I refer to ‘breaches’ of law or guidance, these are my allegations and interpretations unless and until a regulator or court reaches a formal conclusion.

What Happened?

I allege my ASD diagnosis was published in a national blog post and on social media without valid, explicit consent, and I have asked the ICO to review the lawful basis and any special category conditions relied upon.
In my view, the interview process was poorly designed for neurodivergent candidates and did not proactively address reasonable adjustments, despite my disability being recorded in their systems.
In my view, when I raised internal concerns, my disclosure was handled as a standard complaint on two occasions rather than being treated as a systemic governance matter.
I repeatedly requested internal resolution and did not receive the level of engagement I expected from the Association and its trustees; in my view, this represents a serious governance concern.
I allege my Subject Access Request was effectively blocked by disproportionate ID demands.
I did not receive any direct written response from the DPO, and I am not aware of who the DPO individual is.
I am concerned that if Data Protection processes were managed by Legal Services (for example, Legal Services managing data subject access requests), this may affect perceived independence, but this is for regulators to assess.
I am concerned that the Association’s public representations to the press and/or regulators may not align with the documentary timeline, and I have provided relevant materials for review.
Trustees were informed by email, and I have raised concerns about potential conflicts of interest in how some roles were involved.
I allege that the blog and social posts were removed after I notified the Association that I would escalate to regulators; I have asked regulators to consider whether appropriate records and decision trails exist.
I am concerned that the whistleblower and complaints processes, as applied in my case, may not provide sufficient independence at senior level, but this is for regulators to decide.
I allege the blog post was publicly accessible to 500,000+ people, and I am concerned that removal was not prompt after my warning; I have provided the timeline for regulator review.

Legal & Regulatory Breaches

UK GDPR

I allege that UK GDPR requirements may have been engaged, including:

Principles and lawful basis/special category conditions: Concerns about consent and/or other conditions relied upon for processing and publishing my diagnosis as special category data, and concerns about inconsistent explanations given.
Transparency and subject access: Concerns about subject access handling and whether ID requirements were proportionate.
Security and incident consideration: Concerns about public accessibility of special category data and whether any assessment or notification duties were considered.
Accountability documentation: I have not been provided with records of decision-making, any DPIA, or detailed input from the DPO, and I have asked the regulator to assess whether appropriate accountability records exist.

Charity Commission Guidance

Alleged issues under CC3, CC20, CC26, CC27 and CC29:

I allege that trustee oversight and handling of my disclosure raise governance concerns.
To my knowledge, no serious incident report was filed.
In my view, reputational risk, potential conflicts of interest, and data management concerns were not addressed to a standard I would expect.
I am concerned there may have been ineffective whistleblowing handling and weak risk oversight.

Equality Act 2010 (or poor process)

Sections 20–21: In my view, no reasonable adjustments were offered during the selection process despite my disability being on record, which I consider poor practice and reflective of organisational culture.
Section 27: In my view, aspects of the timeline and my experience of the subject access request may raise concerns that a court or tribunal could consider relevant, although only a court or tribunal could decide whether any unlawful victimisation occurred.

Who is Involved?

Listing an external organisation, department, or role below means that I emailed or copied that area in my correspondence. It is not a statement that any specific individual holding that role has broken the law; these are the roles I believe regulators may wish to scrutinise.

External Organisations

Black Penny Consulting Ltd (06607756) (Active Data Protection Officer for The Scout Association)

Departments

Governance
Legal Services
Whistleblowing
Safeguarding
Media Relations
Communications & PR
Brand & Content
Data Protection
Executive Leadership

Individuals (roles)

[REDACTED] - Board of Trustees/Executive Leadership Team
[REDACTED] - Executive Leadership Team
[REDACTED] - Executive Leadership Team
[REDACTED] - Board of Trustees/UK Leadership Team
[REDACTED] - Board of Trustees/UK Youth Team/UK Leadership Team
[REDACTED] - UK Leadership Team
[REDACTED] - Board of Trustees
[REDACTED] - Board of Trustees
[REDACTED] - Brand and Content Team
[REDACTED] - Resolution Team
[REDACTED] - Legal Team
[REDACTED] - Governance Team
[REDACTED] - Brand and Content Team/Employee Forum Team
[REDACTED] - UK Youth Team

Why It Matters

Sensitive youth data may have been mishandled, which could engage high-risk data protection considerations.
Trustees are legally bound to run the charity in line with UK law; in this case, I allege concerns about whether appropriate governance and oversight occurred.
Charity staff and trustees, in my view, responded in ways that appeared to prioritise other factors over legal duty, which may create a perception problem and is for regulators to assess.
In my view, the number of alleged issues affecting a single person over a short period is highly unusual.
If a national charity is ultimately found by regulators to have failed in charity governance and/or data protection obligations, that can harm its relationship with key partners.
Significant regulatory action could occur depending on regulator findings.
National programmes, international events, and partner trust are at stake.
If functions lack independence in handling (for example, Legal Services and Data Protection processes being closely aligned), this may highlight systemic issues, but that is for regulators to decide.
In serious cases, regulators have powers to intervene in a charity’s governance, including measures affecting trustees. If allegations are upheld, there could be consequences for national leadership.
In my view, these alleged issues may reflect concern at The Scout Association toward resolving serious issues.

The Essentials in Detail

Sun, 09 Nov 2025 19:40:49 +0000

This page has been delisted.

Reason: To reduce risk of legal action