gdpr data-protection
Is it reasonable to ask me to change my email address after it was leaked?
<p>My child's school recently sent an email with many parents Cc'd instead of Bcc'd. There was nothing sensitive about the email - it just leaked the email addresses of the other parents. They later acknowledged that this was a data protection breach, and sent an apology.</p>

<p>Along with the apology was some advice from their Data Protection Officer (DPO) to "consider changing your email address".</p>

<p>This feels like an absurd response. If they had leaked my name, should I consider changing my name?</p>

<p>So my question is: is this advice mandated or recommended by any UK or EU law, or the Information Commissioner's Office? Is this considered an appropriate remedy for victims of data breaches?</p>

<p>For the record, I don't feel particularly victmised here. This was an extremely minor breach. I would have preferred just to have an apology and let it be. It's just the absurdity of the response that has made me wonder whether it is the legislation that is the origin of the absurdity.</p>

<blockquote>
  <p>Is it reasonable to ask me to change my email address after it was leaked?</p>
</blockquote>

<p>But they didn't. They asked you to consider changing it - that seems a reasonable thing to ask you to do. Of course, for most people the value of keeping the email address is way higher than the risk from having it leaked so most people will not change it.</p>

<p>However, by asking you to consider changing it they have shifted responsibility (possibly) for any damage the flows from the leak (like having your bank account hacked) from them to you because you made a decision not to change it.</p>
