2

I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people.

One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we have breached GDPR. Apparently, the person has given a wrong emaid ID and it went to this lawyer who is demanding to file a report to the data protection authorities.

While I totally agree that it is a breach under GDPR, what I am interested is to know the consequences and next steps.

P.S: We know all the 10 people personally whose emails are exposed under this breach.

UPDATE

The only PII breached is all 10 of them knows the email address of each other. The content of the email had nothing sensitive.

  • 1
    If you have a lawyer threatening you with action, find your own lawyer to help. – BlueDogRanch Feb 10 at 15:55
  • Was this done by a natural person in the course of a purely personal or household activity? – Lag Feb 10 at 19:10
5

If the lawyer has legitimate concerns, his first port of call would be the ICO https://ico.org.uk/.

Before the ICO will take his complaint further he'll have had write to you expressing his concerns and received a written response that presumably he is unhappy with, and wants to take the issue further.

Most companies have a data compliance team who will have policies and procedures to log breaches like this and decide what course of action to take in response.

Not every breach needs to be brought to the attention of the ICO, and they have a handy self assessment tool to see if you should report the breach.

https://ico.org.uk/for-organisations/report-a-breach/

In your situation, I don't think this constitutes a serious breach which will require investigating. It's simply an admin error. If it is unlikely to pose a risk to any of the individuals they will say something like:

You should keep an internal record of the breach as detailed in Article 33 (5) of the GDPR, including what happened, the effects of the breach and remedial actions taken.

The definition of risk according to the ICO is:

"This risk exists when the breach may lead to physical, material or non-material damage for the individuals whose data have been breached".

So in this case I'd assume a simple apology (Bcc'd :) ) and a record of what happened, how it happened, and the action taken to prevent it happening again should suffice.

| improve this answer | |
  • 2
    Thanks a lot. This helped and resolved the issue. – kingmakerking Feb 10 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.