ICO Reprimands Northern Irish Organisations for Inappropriate Email Disclosure

The Information Commissioner’s office has reprimanded two Northern Irish organisations after it determined that they had inappropriately disclosed personal information via email. The first organisation was the PCC who had sent an email to 15 people each with lived experience of gender dysphoria, using the carbon copy (cc) option; although the body of the email did not contain personal information, recipients could reasonably infer that the other recipients likely had experienced gender dysphoria. Meanwhile, the second organisation - the Executive Office’s Interim Advocate’s Office which had sent an e-newsletter to 251 subscribers - shared email addresses without additional personal information, but given the content, it can be inferred that the subscribers were likely victims and survivors of HIA Inquiry compensation scheme. The ICO found that both organisations had insufficient guidance for staff about sending communications by bulk email, leaving it vulnerable to breaching data protection laws. Consequently, the ICO issued reprimands to both organisations, recommending that both review their policies on sending bulk emails and provide appropriate advice to staff. Both organisations have been asked to report back within three months on the improvements they've made.