1

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later acknowledged that this was a data protection breach, and sent an apology.

Along with the apology was some advice from their Data Protection Officer (DPO) to "consider changing your email address".

This feels like an absurd response. If they had leaked my name, should I consider changing my name?

So my question is: is this advice mandated or recommended by any UK or EU law, or the Information Commissioner's Office? Is this considered an appropriate remedy for victims of data breaches?

For the record, I don't feel particularly victmised here. This was an extremely minor breach. I would have preferred just to have an apology and let it be. It's just the absurdity of the response that has made me wonder whether it is the legislation that is the origin of the absurdity.

  • 7
    Consider is not a request. It is simply advice. – paparazzo Sep 17 '18 at 13:46
  • I don't know the answer (and I did not downvote your question), but much of what I have heard about the GDPR is an absurdity that is going to kill more of productivity and entrepeneurship in the EU. The number of questions about GDPR reflects the effort and resources EU companies/entities sadly need to spend on this instead of being able to focus on their business. – Iñaki Viggers Sep 17 '18 at 13:57
  • 1
    As stated by @paparazzo, this is a suggestion, not an order. The GDPR just says that the data should not have been disclosed (oops) and establishes obligations (reporting to people affected, reporting to authorities) and liability for the data controller if it does things wrong. At a technical level the GDPR is intentionally vague, as the lawmakers cannot know in advance all the different kinds of data that could be leaked and the appropiated answer. – SJuan76 Sep 17 '18 at 20:31
  • 2
    This sounds like either a well intentioned advice to show that the DPO/school cares about it, or even a way to deflect possible complaints "-You have shared my email with other school parents, how do you dare to? -Well, I already did give you a solution for that, why don't just change your e-mail and leave me alone?" (not very effective from a legal POV, but if it convinces people not to sue...) – SJuan76 Sep 17 '18 at 20:34
  • 1
    @IñakiViggers - "The number of questions about GDPR reflects the effort and resources EU companies/entities sadly need to spend on this ..." - Not so surprising, they are same folks who caused most of the problems and aggravated the situations so badly the legislature had to act. Sometimes you make the bed, and other times you get to lie in it. – jww Sep 19 '18 at 6:46
1

Is it reasonable to ask me to change my email address after it was leaked?

But they didn't. They asked you to consider changing it - that seems a reasonable thing to ask you to do. Of course, for most people the value of keeping the email address is way higher than the risk from having it leaked so most people will not change it.

However, by asking you to consider changing it they have shifted responsibility (possibly) for any damage the flows from the leak (like having your bank account hacked) from them to you because you made a decision not to change it.

|improve this answer|||||
  • 1
    Are you sure about a shift in responsibility? If that worked, what's to stop anybody from proposing an impractical solution and saying that if someone didn't do it it's their fault? – David Thornley Dec 20 '18 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.