privacy business
Are you allowed to put a customer&#39;s email address in an internal business email?
<p>Today at work I put a number of our customers' email addresses in an email that only people in the business were CCed on because we were dealing with a matter relating to these customers and their email addresses.</p>

<p>A work colleague told me that it was illegal (breach of privacy) to put our customers' email addresses in the email. Is this true?  The company operates in Australia. </p>

<p>Note that the email I sent was internal. No one outside the company should ever see it.</p>

<p>Businesses do hold customers' email addresses. These are routinely stored and communicated between the businesses' internal IT systems. There is nothing illegal about this.</p>

<p>The only difference that internal <em>email</em> communication makes to the above is that not just machines but <em>employees</em> see the customers' email addresses. So, essentially the question is: is it legal for a business to show its customers' email addresses to its employees?</p>

<p>As per <a href="https://www.oaic.gov.au/privacy-law/privacy-act/australian-privacy-principles" rel="nofollow noreferrer">Australian Privacy Principles</a>, personal information needs to be kept secure. Businesses therefore have duty to do their best not to leak customers' personal information (which includes email addresses). Limiting the circle of people who see personal information only to those who <em>need</em> to see it is essential to perform this duty.</p>

<p>So, essentially, the answer depends on whether all those people CC'ed actually <em>needed</em> to see the email addresses for business purposes. If, for example, one of those people was your office cleaner, then you have done bad job in performing your duty to secure personal information. Should that cleaner leak the email addresses outside the business, you will be held liable.</p>
