At my current place of work a phishing e-mail was sent from an employee's e-mail address (Let's call them Sally). An e-mail originating from Sally's account was sent to everyone's work e-mail within the organisation, it was made aware to everyone within the company that this was a phishing e-mail after the fact and that Sally's account was compromised.

The exact same e-mail was also sent to multiple employees' personal e-mail addresses as well, which means that whomever gained access to Sally's account now has my and others personal e-mail address.

What is a company's responsibility regarding private information of an individual in the case of an unauthorised attacker gaining this information and has GDPR or any other relevant data privacy legislation been breached by the company in this instance.

  • 1
    Why do you assume company have any responsibility regarding private data? – SZCZERZO KŁY Nov 14 '18 at 15:51
  • 2
    This is probably better placed on law.se, since you're asking about a company's legal responsibilities. – berry120 Nov 14 '18 at 16:03
  • Email addresses are not private. I'm not sure what level of privacy you can reasonably expect from something that's given out to nearly every website you have registered with. – Terry Carmen Nov 14 '18 at 17:04

It depends entirely on the context in which "Sally" had your personal email:

If the reason "Sally" had your personal e-mail address was because the company (or Sally acting on behalf of the company) had specifically requested it (say she was working in HR and it comprised part of your employee contact details or something) then they would be considered the "processor" for that Personally Identifying Information (PII) and this could be considered a breach and they would have to notify the ICO although any further steps they may or may not need to take will depend upon what the ICO say and the percieved level of risk to the affected individuals.

If however "Sally" had these personal addresses for non-company purposes then it's not that your employer was acting as a "processor" for the data and therefore they have no obligations under GDPR.

  • Thanks, Sally did indeed have my e-mail as part of her role when recruiting me to the company. – Workplace GDPR Nov 14 '18 at 16:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.