I am a small musician promoting a new song but forgot to put the recipients of a promotional email as BCC (I got the emails off of my presave list). One person has emailed me concerned about their email being visible. I don't know what to do

  • 9
    If it's any consolation, it even happens to IT professionals ...
    – Glorfindel
    Commented May 7 at 19:42
  • 2
    Same happened to me on the receiving side of an invitation to a fetish club, which is perhaps a bit more sensitive. I still don't see the actual harm, if everyone on the list shared the same interests?
    – pipe
    Commented May 7 at 20:18
  • 3
    @pipe Who knows what kinky hook-ups may have resulted from them all getting each other's contact info! ;-) [switching to serious mode for a sec: it's definitely a privacy problem if this happens, and people should take care to prevent it.]
    – Mentalist
    Commented May 8 at 2:48
  • 1
    @pipe while they may share the same interests in terms of hobbies, a serious issue could be if one recipient is overly interested in another, and that's not reciprocated.
    – Chris H
    Commented May 8 at 10:47
  • 1
    @pipe, Someone could sign up with a dummy email just with the hopes of identifying others with that interest in order to blackmail them. Just an example of why it might be dangerous to share that information. Even with a more "innocent" example of liking a particular music source, it could be used to build a profile on a particular person for a variety of purposes.
    – Elros
    Commented May 8 at 17:48

1 Answer 1


Don’t do it again

This is a data breach under the GDPR.

So, you should implement your data breach protocol which you established when you decided to become a data controller. You did do that, right? Well, if you didn’t, you should do it now.

You need to assess the risk to the individuals whose data was breached based on what it was and who got hold of it. If all that was breached is their email addresses and the fact that they like your music, the risk is pretty low. Probably so low you don’t need to report it to the authority or notify them of the breach, but you need to do this assessment, not me. You do need to keep a record of the breach.

Reading between the lines, it also appears that you need to brush up on your obligations as a data controller.

  • I may be missing something obvious but I can't find anything in the post that states their store is in the EU? Commented May 8 at 18:06
  • 1
    @MiniRagnarok OP gave the question the gdpr tag, presumably to indicate that the GDPR applies.
    – TooTea
    Commented May 8 at 19:03

Not the answer you're looking for? Browse other questions tagged .