privacy gdpr email
My email has been shared with other parties
<p>I am in the process of searching for a new job and I have applied for a few.
Today I  received an email from HR representative of one of the companies saying that I was not called for an interview since they found the right candidate for their position.
This is great, so that I will not lose time hoping to get called by this company.</p>

<p>The issue is that this email was in a generic form, and was sent to me and 3 other persons.
So I have the emails of others that applied for, but were not asked for an interview and they have my email too, because the email was sent with all our emails in the To: field!</p>

<p>I assume that it was not done on purpose, but the thing is that it cannot be undone - they cannot delete the emails received by all of us.
This may be some silly mistake by the employee, but I don't like the result of it.</p>

<p>So my questions are:<br>
 - Is this against GDPR?<br>
 - What can I do in this situation?   </p>

<p>I would avoid going to court (if that is an option) and I would avoid contacting the other candidates since they may not have noticed this so far (or maybe they did, who knows).</p>

<blockquote>
  <p>Is this against GDPR?</p>
</blockquote>

<p>It is a violation of the "integrity and confidentiality" principle (<a href="https://gdpr-info.eu/art-5-gdpr/" rel="nofollow noreferrer">Art. 5(1)(f)</a>) provided that:</p>

<ul>
<li>The email addresses leave little or no doubt on who the owners are. That said, an address like <code>djh87s6dg@yahoo.com</code> won't be personal data, while <code>john.smith.31.05.1990@gmail.com</code> well will be; and</li>
<li>the company or one of the addressees are in the EU.</li>
</ul>

<blockquote>
  <p>What can I do in this situation?</p>
</blockquote>

<p>You can notify relevant <a href="https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm" rel="nofollow noreferrer">supervisory authority</a> in accordance with <a href="https://gdpr-info.eu/art-33-gdpr/" rel="nofollow noreferrer">Art. 33</a>.</p>
