Does revealing my personal email address in the To field constitute/qualify as a data breach for under the Australian Privacy Act

Question

An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not authorised to access this information.

That offender was alerted to the existence of the BCC field but today he either brazenly or inadvertently decided to ignore the warning. Does this constitute a data breach under Australian Privacy Act (Cwlth)?

Also, I know that this vorboten under the GDPR. If this information was sent to a an European hosted service and one of the victims was a citizen of one of the European Union countries

Answer 1

It probably violates APP6

Assuming the charity is covered by the Privacy Act - if it has an annual turnover of less than $3 million, it isn’t.

Under APP6, personal information, like an email address, can only be disclosed for the primary purpose for which it was collected or for a secondary purpose if an exception applies.

Assuming that the communication falls within the primary or accepted secondary purpose then disclosing it to people responsible for routing emails is OK. This is true whether there are multiple emails or one email with multiple recipients.

Disclosing it to everyone else on the list probably isn’t. Obviously context matters here; if you were a board member say, and the email disclosed the email addresses of all other board members this is probably a legal disclosure. Similarly, if you are part of a volunteer team and the email was for organising that team. However, if there is no need for you to contact the other people within the approved usage, then this would appear to be a breach.

The act does not give you any individual rights but you can make a complaint.