Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in "TO" field).
The other customer and I have nothing to do with each other and should have been contacted in separate emails. This was just laziness on the agent's part.
Is this a breach of GDPR and, if so, what should the agency do now?
They should report the breach to the regulator within 72 hours of the breach. For a high risk breach, they should also inform the individuals.
However, if the only personal information disclosed was an email address, this is not high risk because people regularly reveal this to many people and organization. Of course, if the context reveals more personal info (e.g. if the email is a client circular from a brothel), then that’s more serious.
