An email address was given for contact to a "charity". The charity then decided to notify a number of individuals on the list without using the BCC field. A number of individual were not authorised to access this information.

That offender was alerted to the existence of the BCC field but today he either brazenly or inadvertently decided to ignore the warning. Does this constitute a data breach under Australian Privacy Act (Cwlth)?

Also, I know that this vorboten under the GDPR. If this information was sent to a an European hosted service and one of the victims was a citizen of one of the European Union countries

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Dale M
    Nov 8, 2022 at 21:52

1 Answer 1


It probably violates APP6

Assuming the charity is covered by the Privacy Act - if it has an annual turnover of less than $3 million, it isn’t.

Under APP6, personal information, like an email address, can only be disclosed for the primary purpose for which it was collected or for a secondary purpose if an exception applies.

Assuming that the communication falls within the primary or accepted secondary purpose then disclosing it to people responsible for routing emails is OK. This is true whether there are multiple emails or one email with multiple recipients.

Disclosing it to everyone else on the list probably isn’t. Obviously context matters here; if you were a board member say, and the email disclosed the email addresses of all other board members this is probably a legal disclosure. Similarly, if you are part of a volunteer team and the email was for organising that team. However, if there is no need for you to contact the other people within the approved usage, then this would appear to be a breach.

The act does not give you any individual rights but you can make a complaint.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .