GDPR - Email Addresses

[HCMM]

Sent an email - which was meant for the two clients - forgot to Blind CC them resulting in them being able to see each others email addresses. We are all working on the project together/have met and the email was for both of them, I know I should have done them separately and I have reported to data protection colleague whose sent it to the correct channels - I feel so stupid and unprofessional, I have never been shown how to blind CC as I usually just sent separate emails but didn't even think as we are all on the same project :(

Wouldn't worry too much as you did the right thing and reported it. It's a low risk breach.

Thank you - the department emailed back asking for more info, no complaints/comments from clients today so hopefully should be sorted for tomorrow and probably will have to do some more training, lesson learnt!

Ask your IT team (or whoever is the right person) if there's an alternative to BCC. It's a very bad way of securing client confidentiality because it relies on humans to implement it. Ideally your workplace will have some means of communicating with clients that doesn't involve humans having to remember to use BCC.

Will ask tomorrow :) Thanks

I've been there and done it myself BTW ;-) I remember that horrible feeling when I realised!

If everyone is working in the same project it would seem highly likely that you have all agreed to share some personal data. It would be very difficult to collaborate otherwise.

I once sent a clients personal details, name, address, national insurance number and details of a confidential transaction to a totally different, unrelated client.

I reported to the GDPR team and absolutely no negative consequences, other than I felt like an idiot for a few days.

Thanks so much for the reassurance :) It's very much apperciated

Thank you for the reply! Yes, honestly such a horrible feeling! Thanks again :)

They are external clients, I think that is where the issue was really but lesson learnt and hopefully sorted tomorrow :)

Even the ICO aren't bothered about this unless the content of the email is highly sensitive (eg patients who are HIV positive and therefore require privacy)

No no, nothing like that. The content was aimed at both clients, I didn’t blind CC their emails, that’s the issue but the content wasn’t sensitive, it ‘nice to meet you’ sort of email