Lourdes1 asks:
On 9 April, an organisation sent two mailshots to ALL 520 people on their list of contacts inviting them to enjoy an Easter-break holiday in the Wye Valley. All 520 email addresses are in the "to" address field and are visible to all. Is the organisation in breach of data protection? What does this mean to the list of 520? Do we "deserve" to be compensated? Is this a frequent mistake? Sometimes deliberate? What is the risk of fraud? Identity theft? Should we worry about spam? Is the organisation expected to contact every name on the email list as soon as they are aware of the security breach?
Judging from my own experience of the "reply to all" phenomenon, I imagine this is not an uncommon situation. Surely everyone has at some stage received an email from a membership organisation or club which inadvertently displays all the recipients' email addresses, followed shortly afterwards by a request from someone you've never met to sponsor them to run the marathon, or come to their gig the following week … you know the kind of thing. Not the most serious intrusion, but depending on the type and size of the organisation, disclosure of email addresses in this way might raise real privacy issues.
The Data Protection Act 1998 (DPA) helps to protect privacy rights by creating a set of rules for those who handle personal data and by giving individuals a number of rights over their personal data and the way it is handled.
I don't know what kind of organisation Lourdes1 is referring to, but any organisation that stores and uses personal data relating to identifiable living individuals, either on a computer or in a paper filing system, is a "data controller" for the purposes of the DPA. Data controllers are obliged to handle personal data in accordance with the eight data-protection principles set out in schedule 1 to the DPA unless a specific exemption applies. The first principle is that data must be processed fairly and lawfully, which requires any processing (including disclosure) to be done either with the consent of the individual or in order to fulfil legal obligations such as contractual obligations. There are some other types of processing which may be lawful but they do not appear to be relevant to the situation Lourdes1 describes.
Because this was presumably a marketing email, it is also governed by the privacy and electronic communications regulations 2003. These regulations provide that email marketing messages should not be sent to individuals without their express permission unless all the following criteria are met:
1. The marketer has obtained your details through a sale or negotiations for a sale.
2. The messages are about similar products or services offered by the sender.
3. You were given an opportunity to refuse the marketing when your details were collected and, if you did not refuse, you were given a simple way to opt out in every future communication.
Even if these criteria are met, however, it does not entitle the data controller to disclose an individual's email address to third parties without their consent. It seems unlikely that Lourdes1 would have consented to her email address being disclosed to the 519 other recipients of the email. Quite apart from the disclosure of the email address itself, if an individual is identifiable from their email address (eg forename.surname@company.com) then displaying it to other recipients reveals that the individual has had some dealing with the organisation in the past. For some organisations (eg political parties, or organisations that deal specifically with sensitive personal issues) this may be a serious breach of privacy.
So it sounds to me that the organisation Lourdes1 refers to has breached the first data-protection principle under the DPA by displaying all 520 email addresses. There is no legal obligation on data controllers to notify individuals of a breach of the DPA, but individuals can complain to the information commissioner who has power to issue enforcement notices, or they may seek compensation under section 13 of the DPA for any contravention of the DPA which causes them damage. Compensation is also available for "distress" caused by a breach, but only if the individual concerned has also suffered quantifiable damage. It seems unlikely that a criminal would be able to commit identity fraud with only an email address, but if Lourdes1 does become a victim of fraud as a result of the disclosure then he may well be entitled to compensation from the organisation.
As for spam, it is worth noting that under section 11 of the DPA you can require any data controller to stop processing your personal data for the purpose of direct marketing. When a data controller receives such a notice, it must comply as soon as it can. You may apply to court for an order if the data controller fails to comply with the notice. Further, if you want to prevent personally addressed marketing material being sent to you by post, you may register with the Mailing Preference Service, and uninvited telesales calls and telemarketing faxes can be prevented by registering with the Telephone Preference Service.