An employee emails a spreadsheet of welfare claimants to the wrong external address. Which characterisation best fits GDPR personal-data breach analysis?
Select an answer to reveal the explanation.
Short Explanation
Wrong inbox, real people—classic oops that still counts. Sending welfare claimant details to a stranger is a confidentiality breach scenario, not just a manners problem. You assess risk and notification duties; you don't shrug because it was 'only email.'
Full Explanation
Unauthorised disclosure of personal data—such as emailing a spreadsheet of welfare claimants to the wrong external address—is a classic confidentiality personal-data breach scenario under the GDPR definition. The controller should promptly contain the incident, assess the likely risk to data subjects given the sensitivity of welfare information, and apply Articles 33–34 notification analysis where thresholds are met. Misdirected email is not a mere etiquette failure; it is unauthorised disclosure to an unintended recipient.
An apology within one business day does not negate breach status or replace risk assessment; courtesy is not a legal cleansing mechanism. Labelling columns with internal case codes does not remove personal-data character when rows still identify or relate to living individuals. Restricting the concept of “breach” to outsider hacking ignores insider mistakes and accidental disclosures, which the Regulation expressly covers alongside malicious attacks.
Exam caveat: human error and personal-data breach are overlapping categories on the CIPP/E exam—do not treat them as mutually exclusive. Operational check: attempt message recall or recipient deletion confirmation, document what fields were exposed, evaluate likely harm (fraud, distress, discrimination), decide supervisory and individual notification, and harden outbound DLP and address-validation controls. In municipal social-services settings, misdirected claimant data can expose vulnerable residents; civic responders should treat the event as a dignity and safety issue, record why weaker “just apologise” options were rejected, and brief leadership on both containment and accountability to the public.