Beware The Use Of "blind copy" Aka "bcc" As A Data Protection Compliance Tool

Data protection law compliance is an iterative process rather than a one-off exercise. I like to think of it like health and safety.... when you discover that the ladder can slip in certain conditions, next time your risk assessment requires the ladder to be lashed to the building. And the same is true of data protection breaches.

In the case of mass emailing, be it for announcements, marketing campaigns or service messages, it has become received wisdom that in order to protect personal data, that the blind copy ("bcc") function should be used rather than the copy function ("cc".)

In the simplest terms this means that any particular recipient of the email cannot see who else has received the email and therefore cannot make inferences about the other recipients based on the content of the email. Using "bcc" also has the added bonus of concealing email addresses from any other recipient who may cheekily and unscrupulously "scrape" the "to" or "cc" fields in order