4 ms·

I'm not sure that's a violation of GDPR. If person A has accidentally authorised their personal correspondence to be sent to person B they are pretty culpable f

I'm not sure that's a violation of GDPR. If person A has accidentally authorised their personal correspondence to be sent to person B they are pretty culpable for the consequence. Good systems require you to verify your email address, but I'm not sure there's a legal requirement to enforce that. Regardless, it's a very different problem to a bug introduced by the company that leaks customer information.

richrichardsson 6y ago
> I'm not sure that's a violation of GDPR. I think the initial communication is obviously not the fault of the company, but as soon as they are aware and refuse to put right the situation, I think they are very much at fault.
- icu 6y ago
  Exactly, honest mistakes can, and do, happen. The cause should be investigated and if minor, logged on a register; if serious, it must be reported to the regulator.
  - richrichardsson 6y ago
    The initial email was pretty bad, I immediately deleted it and contacted them, but it included: - Full name - Date of Birth - Some kind of National ID number - Bank account details - Address If I was of a lesser moral character I'm sure I could have been very naughty with that information.
hnick 6y ago
Another possibility is the email address is read out (such as over the phone) and a staff member transcribes it incorrectly.
icu 6y ago
It's definitely a GDPR breach, but it may not necessarily be reportable to the data regulator. Imho it should definitely be reported to the data protection officer first before going to the regulator. Most frontline staff have no idea how to handle GDPR queries or issues, but it's the designated data protection officer's role to be responsible.
lmkg 6y ago
GDPR has a requirement that data be accurate (Article 5, section 1 d). This is applicable in practice because of the Right to Rectification, Article 16. https://gdpr-info.eu/art-16-gdpr/ https://gdpr-info.eu/art-16-gdpr/ The initial issue is probably not a violation of GDPR, and not a reportable data breach. However, not fixing the issue after it was brought to their attention is more likely to be a violation.

richrichardsson 6y ago

> I'm not sure that's a violation of GDPR. I think the initial communication is obviously not the fault of the company, but as soon as they are aware and refuse to put right the situation, I think they are very much at fault.

icu 6y ago
Exactly, honest mistakes can, and do, happen. The cause should be investigated and if minor, logged on a register; if serious, it must be reported to the regulator.
- richrichardsson 6y ago
  The initial email was pretty bad, I immediately deleted it and contacted them, but it included: - Full name - Date of Birth - Some kind of National ID number - Bank account details - Address If I was of a lesser moral character I'm sure I could have been very naughty with that information.

hnick 6y ago

Another possibility is the email address is read out (such as over the phone) and a staff member transcribes it incorrectly.

icu 6y ago

It's definitely a GDPR breach, but it may not necessarily be reportable to the data regulator. Imho it should definitely be reported to the data protection officer first before going to the regulator. Most frontline staff have no idea how to handle GDPR queries or issues, but it's the designated data protection officer's role to be responsible.

lmkg 6y ago

GDPR has a requirement that data be accurate (Article 5, section 1 d). This is applicable in practice because of the Right to Rectification, Article 16. https://gdpr-info.eu/art-16-gdpr/ https://gdpr-info.eu/art-16-gdpr/ The initial issue is probably not a violation of GDPR, and not a reportable data breach. However, not fixing the issue after it was brought to their attention is more likely to be a violation.