gdpr
Accidentally used &quot;to&quot; instead of using &quot;bcc&quot; while sending out email [GDPR violation]
<p>I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people.</p>

<p>One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we have breached GDPR. Apparently, the person has given a wrong emaid ID and it went to this lawyer who is demanding to file a report to the data protection authorities. </p>

<p>While I totally agree that it is a breach under GDPR, what I am interested is to know the consequences and next steps.</p>

<p>P.S: We know all the 10 people personally whose emails are exposed under this breach.</p>

<p><strong>UPDATE</strong></p>

<p>The only PII breached is all 10 of them knows the email address of each other. The content of the email had nothing sensitive. </p>

<p>If the lawyer has legitimate concerns, his first port of call would be the ICO <a href="https://ico.org.uk/" rel="noreferrer">https://ico.org.uk/</a>.  </p>

<p>Before the ICO will take his complaint further he'll have had write to you expressing his concerns and received a written response that presumably he is unhappy with, and wants to take the issue further.  </p>

<p>Most companies have a data compliance team who will have policies and procedures to log breaches like this and decide what course of action to take in response.</p>

<p>Not every breach needs to be brought to the attention of the ICO, and they have a handy self assessment tool to see if you should report the breach.</p>

<p><a href="https://ico.org.uk/for-organisations/report-a-breach/" rel="noreferrer">https://ico.org.uk/for-organisations/report-a-breach/</a></p>

<p>In your situation, I don't think this constitutes a serious breach which will require investigating.  It's simply an admin error.  If it is unlikely to pose a risk to any of the individuals they will say something like:</p>

<blockquote>
  <p>You should keep an internal record of the breach as detailed in
  Article 33 (5) of the GDPR, including what happened, the effects of
  the breach and remedial actions taken.</p>
</blockquote>

<p>The definition of risk according to the ICO is:</p>

<blockquote>
  <p>"This risk exists when the breach may lead to physical, material or
  non-material damage for the individuals whose data have been
  breached".</p>
</blockquote>

<p>So in this case I'd assume a simple apology (Bcc'd :) ) and a record of what happened, how it happened, and the action taken to prevent it happening again should suffice.</p>
