1

My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later acknowledged that this was a data protection breach, and sent an apology.

Along with the apology was some advice from their Data Protection Officer (DPO) to "consider changing your email address".

This feels like an absurd response. If they had leaked my name, should I consider changing my name?

So my question is: is this advice mandated or recommended by any UK or EU law, or the Information Commissioner's Office? Is this considered an appropriate remedy for victims of data breaches?

For the record, I don't feel particularly victmised here. This was an extremely minor breach. I would have preferred just to have an apology and let it be. It's just the absurdity of the response that has made me wonder whether it is the legislation that is the origin of the absurdity.

Improve this question
6
  • 7
    Consider is not a request. It is simply advice.
    – paparazzo
    Sep 17, 2018 at 13:46
  • I don't know the answer (and I did not downvote your question), but much of what I have heard about the GDPR is an absurdity that is going to kill more of productivity and entrepeneurship in the EU. The number of questions about GDPR reflects the effort and resources EU companies/entities sadly need to spend on this instead of being able to focus on their business.
    – Iñaki Viggers
    Sep 17, 2018 at 13:57
  • 1
    As stated by @paparazzo, this is a suggestion, not an order. The GDPR just says that the data should not have been disclosed (oops) and establishes obligations (reporting to people affected, reporting to authorities) and liability for the data controller if it does things wrong. At a technical level the GDPR is intentionally vague, as the lawmakers cannot know in advance all the different kinds of data that could be leaked and the appropiated answer.
    – SJuan76
    Sep 17, 2018 at 20:31
  • 2
    This sounds like either a well intentioned advice to show that the DPO/school cares about it, or even a way to deflect possible complaints "-You have shared my email with other school parents, how do you dare to? -Well, I already did give you a solution for that, why don't just change your e-mail and leave me alone?" (not very effective from a legal POV, but if it convinces people not to sue...)
    – SJuan76
    Sep 17, 2018 at 20:34
  • 1
    @IñakiViggers - "The number of questions about GDPR reflects the effort and resources EU companies/entities sadly need to spend on this ..." - Not so surprising, they are same folks who caused most of the problems and aggravated the situations so badly the legislature had to act. Sometimes you make the bed, and other times you get to lie in it.
    – jww
    Sep 19, 2018 at 6:46

1 Answer 1

Reset to default
1

Is it reasonable to ask me to change my email address after it was leaked?

But they didn't. They asked you to consider changing it - that seems a reasonable thing to ask you to do. Of course, for most people the value of keeping the email address is way higher than the risk from having it leaked so most people will not change it.

However, by asking you to consider changing it they have shifted responsibility (possibly) for any damage the flows from the leak (like having your bank account hacked) from them to you because you made a decision not to change it.

Improve this answer
1
  • 1
    Are you sure about a shift in responsibility? If that worked, what's to stop anybody from proposing an impractical solution and saying that if someone didn't do it it's their fault?
    – David Thornley
    Dec 20, 2018 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .