1

Today at work I put a number of our customers' email addresses in an email that only people in the business were CCed on because we were dealing with a matter relating to these customers and their email addresses.

A work colleague told me that it was illegal (breach of privacy) to put our customers' email addresses in the email. Is this true? The company operates in Australia.

Note that the email I sent was internal. No one outside the company should ever see it.

3

Businesses do hold customers' email addresses. These are routinely stored and communicated between the businesses' internal IT systems. There is nothing illegal about this.

The only difference that internal email communication makes to the above is that not just machines but employees see the customers' email addresses. So, essentially the question is: is it legal for a business to show its customers' email addresses to its employees?

As per Australian Privacy Principles, personal information needs to be kept secure. Businesses therefore have duty to do their best not to leak customers' personal information (which includes email addresses). Limiting the circle of people who see personal information only to those who need to see it is essential to perform this duty.

So, essentially, the answer depends on whether all those people CC'ed actually needed to see the email addresses for business purposes. If, for example, one of those people was your office cleaner, then you have done bad job in performing your duty to secure personal information. Should that cleaner leak the email addresses outside the business, you will be held liable.

  • Hi, thank you. The only people CCed were the manager of Customer Relations, and a few people in the IT department who will be performing the work related to topic of the email. – JRG Jun 5 at 2:57
  • @JRG It appears perfectly legal then on the face if it. Whoever told you it is not needs to articulate. – Greendrake Jun 5 at 3:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.