Is this a data protection breach?

Nonoperational

So, 2 friends of mine purchased 2 new cars. In error, one of them got sent an email at the end of December from the car dealer. This email had the names, addresses, email addresses and car purchased details of every customer that bought 161 cars in Nov and Dec.

One of my friends contacted the dealer and asked them about it and they have not responded. Is it a data protection breach? Should they have told the affected parties?

Thanks for the input.

hullaballoo

Yep, that's pretty much data protection breaching for dummies 101.

Nonoperational

Yep. My friend emailed them outlining what happened. They send a generic response and nothing since. That was 2 weeks ago. My other friend, who's name and details was on the list, is very disappointed they haven't contacted him to let him know.

hullaballoo

The DPC ought to be informed. It's very important that this sort of thing isn't just seen as a mistake anyone could make and is dealt with properly.

Nonoperational

Yes, I think I have given them long enough to do the right thing. They are clearly trying to sweep it under the carpet.

Frynge

I would reckon it was just an accident by someone in the dealer but it should be reported as it is amazing how many businesses still have no understanding data protection.

gizmo555

Nonoperational wrote: »

Yep. My friend emailed them outlining what happened. They send a generic response and nothing since. That was 2 weeks ago. My other friend, who's name and details was on the list, is very disappointed they haven't contacted him to let him know.

It's a key principle of reporting data breaches that the people whose data was disclosed should be promptly advised, so that they can individually consider what measures they need to take to protect themselves from any risks that arise.

The car dealer here has been, it seems, very remiss in not quickly advising people of the error. If your friends are bothered by the matter, they can submit a complaint online to the Data Protection Commisioner here:

https://www.dataprotection.ie/raise-a-concern/ComplaintForm.aspx

The_Minister

Fun anecdote:

I was attending a data protection conference some time ago.
A few days before they sent an email reminder with the e-mail addresses of all attendees listed.

Losty Dublin

The_Minister wrote: »

Fun anecdote:

I was attending a data protection conference some time ago.
A few days before they sent an email reminder with the e-mail addresses of all attendees listed.

An internal e-mail which was sent around our office yesterday was helpfully sent by one officer from another ones e mail account with full contact details of another one as a point of contact. And all to let us know about Data Protection Day and to emphasise not passing on personal details

C.K Dexter Haven

Nonoperational wrote: »

So, 2 friends of mine purchased 2 new cars. In error, one of them got sent an email at the end of December from the car dealer. This email had the names, addresses, email addresses and car purchased details of every customer that bought 161 cars in Nov and Dec.

One of my friends contacted the dealer and asked them about it and they have not responded. Is it a data protection breach? Should they have told the affected parties?

Thanks for the input.

Standard response to this incidence would be to contact you ASAP, apologise, and ask you to delete the email. Then, contact all of the relevant parties letting them know there was a data breach. They're definitely trying to play it down.