Is sending an email to the wrong recipient automatically a GDPR violation?

Sending an e-mail to the wrong recipient by mistake is “potentially” an infringement of Articles 5 and 6 of the GDPR, says Belgian DPA, in a “prima facie” decision that may cause a stir.

In proceedings before it, the Belgian DPA can decide whether to take a preliminary decision *before* any decision on the merits. Here, the Belgian DPA took a prima facie decision with the aim of “notifying the defendant of the fact that it may have committed a violation of the provisions of the GDPR and to give it the opportunity to still conform to the aforementioned provisions”.

The context:

– A notary public sends an e-mail intended for various heirs, but includes a third party (the “third person” in the decision) by mistake

– That person responds to all by saying “Wrong e-mail address, this is not for me

– “Since the third person […] was incorrectly addressed, […] sending the e-mail to the third person was not part of the original purpose of processing the personal data” [para. 7]

– “Taking into account the criteria included in Article 6.4 GDPR and Recital 50 GDPR, it should thus be examined whether or not the further processing, in this case the sending of the e-mail to the third person, is compatible with the initial processing in the context of the sale of the testator’s property. […] In the case at hand, the complainant could not reasonably expect the [controller] to share the data with the third person, since that person is not involved in the sale of the property.” [para. 8]

– “This leads to a finding of potentially incompatible further processing. In that case, a separate legal basis would be required for the transmission of the complainant’s personal data to the third person to be considered lawful.” [para. 9]

– “Since the [controller] also refers to the third person as the “erroneous addressee,” it can be understood that forwarding the personal data to the third person was not the purpose of the [controller]. The processing in question could thus be classified as an error, and not as a processing for which the respondent had established a legal basis in advance. […] the Litigation Chamber considers that the defendant cannot prima facie rely on any legal basis that would demonstrate the lawfulness of the processing.” [para. 11]

=> “potentially” breach (= infringement) of 5(1)(a), 5(1)(b) and 6(1) GDPR

Basically, per the BDPA, any e-mail to a wrongful recipient is an unlawful processing of personal data (!).

Does this mean that in their view, any human error is in and of itself causing unlawful processing? Following that reasoning, could the inputting of inaccurate data because of a typo be deemed to be a breach of the principle of accuracy and thus not in line with the data subject’s expectations and thus unjustified & incompatible processing?

To be seen whether there is an appeal – it’s just a reprimand. (You can guess what I would advise, though)

Link (decision in Dutch): https://lnkd.in/ebVuWMzd

data protection privacy