ICO Imposes EUR224,000 Fine For ‘BCC'/'CC'/'TO' Blunder

Before clicking 'Send', check and check again!

Sending an email to the wrong recipient is perhaps one of the most common types of data breach that can occur. One example is erroneously sending a Carbon Copy ('CC') email or an email with recipients in the 'TO' field instead of a Blind Carbon Copy ('BCC') email. This can have serious implications in terms of general confidentiality obligations as well as significant implications in terms of the EU General Data Protection Regulation ('GDPR') which came into effect across the EU, including Malta, on 25^th May 2018.

This is exactly what happened in February 2017 to the 'Independent Inquiry into Child Sex Abuse' ('IICSA') when an IICSA staff member sent out a bulk email to ninety (90) possible victims of child sexual abuse participating in the inquiry. Instead of sending an email to the ninety (90) participants by using the 'BCC' field (so that the participants would not see each other's details), the IICSA staff member