I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people.
One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we have breached GDPR. Apparently, the person has given a wrong emaid ID and it went to this lawyer who is demanding to file a report to the data protection authorities.
While I totally agree that it is a breach under GDPR, what I am interested is to know the consequences and next steps.
P.S: We know all the 10 people personally whose emails are exposed under this breach.
The only PII breached is all 10 of them knows the email address of each other. The content of the email had nothing sensitive.