Is this a breach of GDPR?

No it isn't.

Personal data breaches: a guide | ICO

When a personal data breach has occurred, you need to establish the likelihood of the risk to people’s rights and freedoms. If a risk is likely, you must notify the ICO; if a risk is unlikely, you don’t have to report it. However, if you decide you don’t need to report the breach, you need to be able to justify this decision, so you should document it.

The breach itself is pretty trivial. Sending personal data to the wrong recipient is a notifiable breach which the organisation at fault should really report to the ICO itself. If it hasn't that's arguably a bit more serious but I'd still be surprised if the ICO does any more than insist better processes are put in place to prevent this happening again.

It's a breach, but a fairly trivial one in all likelihood (unless someone uses the information nefariously)

it’s more about the impact than the action

absolutely & the emailer can’t possibly know the impact.

in another example, my Dh was a teacher. Imagine if the parents of one of his students got hold of his personal email address.

Absolutely

The Foreign Office used CC to email Afghan translaters fleeing Afghanistan

ICO fines Ministry of Defence for Afghan evacuation data breach | ICO

On 20 September 2021, the MoD sent an email to a distribution list of Afghan nationals eligible for evacuation using the ‘To’ field, with personal information relating to 245 people being inadvertently disclosed. The email addresses could be seen by all recipients, with 55 people having thumbnail pictures on their email profiles. Two people ‘replied all’ to the entire list of recipients, with one of them providing their location.

They were in a rush

I've been a volunteer for several charities and have inadvertently used CC instead of BCC for mass mailings several times, felt mortified when I realised jad sent an immediate apology asking everyone to delete the email with the CC's. This man is behaving like an idiot in not acknowledging his mistake, if it was one; or not reading up about GDPR if he did it intentionally. However, most likely nobody will come to harm over having their email address shared with fellow tenants so probably best try to forget it.

It’s not really a big deal though and I struggle to see why people are making such a big issue. It’s not even clearly a breach and certainly the ICO would never take action over something like this

An organisation I was part of had a volunteer who used to email out newsletters to everyone without using BCC and couldn't be made to see what she was doing wrong. She finally got the message when someone with MH difficulties started sending emails to everyone one NYE, complaining that the organisation hadn't arranged something for that night and people were getting very angry at receiving these messages.

This happened with a group I'm involved with. A new admin person started and sent out an introductory email using CC instead of BCC.

I dropped them a message and explained in a friendly way that it's a data breach and they should use BCC in future.

They apologised and said it was a silly mistake and they know now for next time.

That's all you need to happen. There doesn't need to be drama.

I hope no-one signs up the guy's email address for a load of spam / newsletters so he sees how carelessly misusing email addresses can be, at the very least, a nuisance.

Ha, that's mad.
If you handle data in any way, volunteer or otherwise, you need to know how to handle it lawfully.

So for example someone who my children went to school with had an unusual surname. They also happened to be a medical professional working in mental health services with some unstable/volatile people. They were once followed around town by a patient who recognised them.

A stray email could alert someone to the fact that they live in that block of flats. That is just one example.

Being a volunteer does not absolve you from GDPR responsibilities. I was a volunteer for many years and although it was before GDPR I knew what I could and could not do and what the consequences might be.

It is probably not a reportable breach, unless it contained embarrassing or sensitive information about the recipients.

I doubt the ICO would be interested as it’s more of an admin oversight. Email addresses are personal information but on their own they don’t identify anyone personally.

However, the YMCA were fined a considerable sum when the same thing happened, because the email was about treatment in a sexual health service, therefore incredibly sensitive.

it’s more about the impact than the action.

whilst it is a privacy breach it’s so low level as to be irrelevant to the ICO (for context I regularly liaise with Supervisory Authorities on matters where significant amounts of sensitive data have been breached and there’s a rarely any consequence).

I actually have a lot of sympathy with the volunteer who is currently under fire. The reality is these are often thankless tasks which are absolutely necessary and I imagine the pile on is making them question why they bother.

Just leave this storm in a teacup to blow itself out. It's not a major breach, the ICO will be 0% interested, everybody will get the fuck over it eventually.

Most common course of data breaches.
Along with using autofill and putting in the wrong email address - because people are in a rush.

The GDPR violation is not so much in the fact that the e-mails were sent, as that the TA has not put steps in place to stop it happening. That is, whoever sent the mail should have undergone training as to how to send an e-mail to 50 people securely.

I suspect that there are many millions of very small organisations that have not done that. To do so would have collectively cost them hundreds of millions of pounds. I don't think the tenants would necessarily be impressed to find a line item in the expenses for £200 or whatever to learn how to send e-mails. There might be comments about "bureaucracy gorn mad".

As a data breach, it's really not the end of the world. E-mail addresses are not really ultra-sensitive information about the average person (and if yours is, then get a burner Gmail account for everyone except your CIA handlers or whatever). If you know only that the person who lives below you is called Clyde and there is a Clyde.Barrow47(at)btinternet.com on the list, well, you've learned his surname. Nobody is going to be harvesting the addresses for spam.

(I'm old enough to remember when you were meant to be very careful with your phone number, but WhatsApp has basically put paid to that.)

As pp said it is a data breach but it's a minor one as the data is not sensitive.

It's best dealt with through common sense, the sender should apologise and ask recipients to delete the email.

Strictly speaking yes but it’s minor (if annoying for some) so the ICO won’t do anything.