Personal Data Protection Authority: Data Breach Notification Concerning Online Market Retailer

The data controller has made a data breach notification, detailed below, to the Personal Data Protection Authority ("Authority");

• While sending an e-mail to a group of 400 recipients by the data controller employee; it was indicated that the e-mail addresses of 43 customers were mistakenly added to the subject part of the e-mail instead of being added to the BCC part of the e-mail, and 43 recipient information was shared with a group of 400 recipients.
• It has been reported that the contact information (e-mail) and identity information (name and surname information in the e-mail addresses) data of 43 related persons were affected by this breach.
• It has been stated that, as soon as the e-mail was sent, the mistake has been noticed by the employee, although it was not possible to recall the e-mails, the contacts affected by the breach have been informed within 48 hours and their level of exposure of the breach has been minimized.