Not named in the source

What happened

The Belgian DPA held, among others, that a controller is not obliged to report a data breach which results from listing the recipients of an email in CC instead of BCC if the email is only received by a small group (16 people).

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subjectRead →
• Art. 13Information to be provided where personal data are collected from the data subjectRead →
• Art. 30Records of processing activitiesRead →
• Art. 33Notification of a personal data breach to the supervisory authority33(1)Read →

• Data breach
• Transparency