united-kingdom gdpr email
Is my name and email address being sent to another customer a GDPR violation?
<p>An agency, to which I provided my personal email address (contains my full name), has emailed me and another of their customers (both emails in &quot;TO&quot; field).</p>
<p>The other customer and I have nothing to do with each other and should have been contacted in separate emails. This was just laziness on the agent's part.</p>
<p>Is this a breach of GDPR and, if so, what should the agency do now?</p>

<h2>Yes, it’s a breach of the GDPR</h2>
<p>They should <a href="https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/obligations/what-data-breach-and-what-do-we-have-do-case-data-breach_en" rel="nofollow noreferrer">report</a> the breach to the regulator within 72 hours of the breach. For a high risk breach, they should also inform the individuals.</p>
<p>However, if the only personal information disclosed was an email address, this is not high risk because people regularly reveal this to many people and organization. Of course, if the context reveals more personal info (e.g. if the email is a client circular from a brothel), then that’s more serious.</p>
