The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.

Search this blog

Recent Posts

On Twitter

About this page and the author

The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.

For full contact information and a brief bio, please see David's profile.

Please note that I am only able to provide legal advice to clients. I am not able to provide free legal advice. Any unsolicited information sent to David Fraser cannot be considered to be solicitor-client privileged.

David Fraser's Facebook profile

Privacy Calendar



Subscribe with Bloglines

RSS Atom Feed

RSS FEED for this site

Subscribe to this Blog as a Yahoo! Group/Mailing List
Powered by

Subscribe with Bloglines
Add to Technorati Favorites!

Blogs I Follow

Small Print

The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.

This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.

Saturday, October 30, 2004

Data protection watchdog distributes email mailing list (The Register) 

It is staggeringly easy to accidentally send an e-mail to a large distribution list, placing the addresses in the "TO:" or the "CC:" field instead of the "BCC:" field. A number of incidents of this have led to significant consequences for the senders who have accidentally breached the privacy of the recipients. Recently, a customer loyaty program did this in Canada, resulting in a complaint to the federal Privacy Commissioner. (See PIPED Act Case Summary #277: Mass mailout results in disclosure of contest entrants e-mail addresses.) A large drug company did the same in the United States, leading to a significant penalty from the FTC. (See ACLU Knocks Eli Lilly for Divulging E-Mail Addresses: Site's prescription reminder reveals names of recipients.)

In a recent incident, slightly tinged with irony, the Dutch Data Protection Authority did the same thing:

Data protection watchdog distributes email mailing list | The Register:

"The Dutch Data Protection Authority (Dutch DPA), which supervises the compliance with acts that regulate the use of personal data, was rather red-faced this week when it sent out a newsletter with all of the recipients in the Cc: field instead of the Bcc: field.

DPA's news letter goes out to 4000 subscribers. The DPA, which supervises the compliance with the Dutch Personal Data Protection Act and the Dutch Municipal Database Personal Records Act, was lucky that 'only' a thousand subscribers received the letter, but it managed to make the mistake twice. In a message it apologised for sending the first letter, again putting all recipients to the Cc list, so a second apology had to be sent."

These happen so often that I think Outlook and other mail programs should have a function that asks if you are sure you want to send a message with more than five/ten/whatever recipients in the "CC:" field....


10/30/2004 06:48:00 AM  :: (1 comments)  ::  Backlinks
Great blog,
I surf a lot a day, and want to tell you yours is cool:
Free Email Pays
Post a Comment

Links to this post:

Create a Link

This page is powered by Blogger. Isn't yours? Creative Commons License
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License. lawyer blogs