Posted yesterday by the Office of the Privacy Commissioner of Canada:
Service provider inadvertently discloses email addresses of nearly 300 customers in mass email
Incident
A customer of a service provider received a routine email from the service provider advising her of when her seasonal service would be reconnected. However, she noticed that the email had also been simultaneously sent to many other customers, whose email addresses were clearly visible, as was her own, in the address field. As a result, the customer alerted our Office about the incident.
Outcome
The service provider advised our Office that nine mass emails had occurred on that day, involving nearly 300 email addresses of individual customers. The organization explained that in these mass emails, the email address of each recipient had been displayed and shared with multiple customers since the addresses had been entered into the “cc” field rather than the “bcc” field.
Within the first half hour of detecting the error, the organization made attempts to recall all unopened emails to mitigate the impact on customers. Each customer impacted by the incident received a subsequent email from the organization, containing an apology for the error, a description of it and the actions that were taken to rectify the situation. Customers were also given the contact information of a supervisor with whom they could discuss the incident if they wished. Later, communications were sent to, and learning sessions were held with, managers, supervisors and company leaders to inform them of the incident, with a view to implementing a more secure, automated process/system for sending out mass emails.
Consequently, within a week of the incident, a new process for best practices when sending out mass emails was established for the organization. The new process includes: (a) avoiding mass emails, in general, and using alternative and more personal methods of contact (i.e., phone) wherever possible; (b) involving the marketing team for mass emails that need to be sent; (c) requiring supervisor and manager review and approval of mass emails prior to being sent; (d) using a mail merger program to ensure confidentialilty; and (e) ensuring that mass emails being sent do not contain the confidential information of customers.
Final Comment
The service provider was able to demonstrate to our Office that it implemented best practices for sending mass e-mails in response to this incident. Our Office strongly encourages other organizations subject to the Act to implement similar processes to avoid an inadvertent disclosure of personal information when sending a mass email to its customers.