My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later acknowledged that this was a data protection breach, and sent an apology.
Along with the apology was some advice from their Data Protection Officer (DPO) to "consider changing your email address".
This feels like an absurd response. If they had leaked my name, should I consider changing my name?
So my question is: is this advice mandated or recommended by any UK or EU law, or the Information Commissioner's Office? Is this considered an appropriate remedy for victims of data breaches?
For the record, I don't feel particularly victmised here. This was an extremely minor breach. I would have preferred just to have an apology and let it be. It's just the absurdity of the response that has made me wonder whether it is the legislation that is the origin of the absurdity.