I am in the process of searching for a new job and I have applied for a few. Today I received an email from HR representative of one of the companies saying that I was not called for an interview since they found the right candidate for their position. This is great, so that I will not lose time hoping to get called by this company.

The issue is that this email was in a generic form, and was sent to me and 3 other persons. So I have the emails of others that applied for, but were not asked for an interview and they have my email too, because the email was sent with all our emails in the To: field!

I assume that it was not done on purpose, but the thing is that it cannot be undone - they cannot delete the emails received by all of us. This may be some silly mistake by the employee, but I don't like the result of it.

So my questions are:
- Is this against GDPR?
- What can I do in this situation?

I would avoid going to court (if that is an option) and I would avoid contacting the other candidates since they may not have noticed this so far (or maybe they did, who knows).

  • 1
    "Is this against GDPR?" (probably) has a yes/no answer, and if it's "yes" then you (probably) have a right to seek compensation - but how would you quantify the damage you've suffered as a result of your email address being accidentally shared with 3 other individuals who are in a similar position to yourself? In all likelihood, the result of you filing a complaint would be that the company gets a slap on the wrist, the offending employee gets anything between a talk with their manager to a written warning, and you get little more than some brief satisfaction ...
    – brhans
    Oct 4, 2018 at 13:48
  • 2
    The answer to "What can I do" depends on what you're concerned about. I'm probably just missing something, but I don't understand why you're bothered by three strangers having your e-mail address. Their possession of it seems a lot no more dangerous to me (less so, even) than the employer's possession of it, which you presumably don't mind.
    – bdb484
    Oct 4, 2018 at 15:36
  • @bdb484 When I applied for the job, I knew I am sharing my email address so I see it as a necessity for a future employer to have my email address. Besides that I expect that the employer will not use/give my email address knowingly, since I think an employer is more strict about obeying to the legal requirements regarding personal data, compared to a stranger that received such data by accident (and I don't know who he/she is).
    – dragi
    Oct 4, 2018 at 15:46
  • @bdb484 I know that my case actually shows that the employer shared my email, while the 3 strangers so far didn't (they are innocent until proven guilty), but still I suppose the consequences (charges?) would be larger for an employer, than for some legal person. Sorry if I don't use correct terms.
    – dragi
    Oct 4, 2018 at 15:57
  • This is a data breach as defined in Art. 33 GDPR. As the sender might not have noticed this, you should inform them. Then they must send a notification to the supervisory authority within 72 hours. You can remind them about that article. Some parts of that notification must also be communicated to you (Art. 34 GDPR). So wait what they say about the consequences and measures taken. If you are not happy with the reaction, you can take further steps.
    – wimh
    Oct 4, 2018 at 19:47

1 Answer 1


Is this against GDPR?

It is a violation of the "integrity and confidentiality" principle (Art. 5(1)(f)) provided that:

  • The email addresses leave little or no doubt on who the owners are. That said, an address like [email protected] won't be personal data, while [email protected] well will be; and
  • the company or one of the addressees are in the EU.

What can I do in this situation?

You can notify relevant supervisory authority in accordance with Art. 33.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .