An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field).

The other customer and I have nothing to do with each other and should have been contacted in separate emails. This was just laziness on the agent's part.

Is this a breach of GDPR and, if so, what should the agency do now?

1 Answer 1


Yes, it’s a breach of the GDPR

They should report the breach to the regulator within 72 hours of the breach. For a high risk breach, they should also inform the individuals.

However, if the only personal information disclosed was an email address, this is not high risk because people regularly reveal this to many people and organization. Of course, if the context reveals more personal info (e.g. if the email is a client circular from a brothel), then that’s more serious.

  • From your link "...poses a risk to an individual’s rights and freedoms..." would that include the right keep my email address private? Also, I should have noted, my name is unique so you can certainly assume that the email address is mine. Does that change anything?
    – Griffin
    Commented Apr 4, 2022 at 12:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .