An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not authorised to access this information.
That offender was alerted to the existence of the BCC field but today he either brazenly or inadvertently decided to ignore the warning. Does this constitute a data breach under Australian Privacy Act (Cwlth)?
Also, I know that this vorboten under the GDPR. If this information was sent to a an European hosted service and one of the victims was a citizen of one of the European Union countries