What happened
On 21 and 24 July 2025 the National Federation of Orders of Biologists sent two certified emails (PEC, Italy's registered email) to a large group of members, with every address in the recipients field: each person could see all the others. One biologist complained. The Federation explained that it was a human error and that the PEC system it used did not allow recipients to be put in blind copy. With decision no. 763 of 7 October 2026, published on 20 October, the Garante fined it €2,000 for breaching Articles 5 and 6 GDPR and Article 2-ter of the Italian Privacy Code.
The fine is low and the Garante explains why: an isolated breach due to human error, only email addresses and no special-category data, no previous infringements, good cooperation and corrective measures already in place. But the decision was published anyway, precisely because of the large number of recipients, and the principle it states applies to everyone.
Why a visible address is a disclosure of data
A named email address is personal data. Putting it in the To or CC field of a group message means disclosing it to all the other recipients, that is, to third parties. That requires a legal basis and, for a public body under Article 2-ter of the Italian Code, a rule that provides for it. It is not enough that the recipients belong to the same profession, nor that the sending was a mistake: the mistake explains the seriousness, it does not make the processing lawful.
- A technical limit of the tool is not a justification: if the system does not allow blind copy, change the way you send.
- The alternatives are simple: individual messages, mail merge, a bulk-mailing platform, a distribution list that does not expose addresses.
- Named addresses weigh more than generic ones: firstname.lastname@ says who the person is, info@ does not.
- A message with visible recipients is also a confidentiality breach: assess it as a personal data breach and record it in the breach register, even if it is not notified.
- The rule must be written down and taught: the person who sends circulars is often not the person who wrote the privacy procedures.
The check to run today in every firm and every body
Ask whoever sends group messages to show you the last email sent to more than five people. Look at the recipients field. If the addresses are visible, the problem already exists; if they are in blind copy, ask whether that is a written rule or just that person's habit. Then ask the same question about certified or registered email, which often goes through a different program and a different person.
The case is particularly relevant for professional bodies, associations, schools, property managers and anyone who regularly writes to a list of people who do not know each other. These are the messages where the mistake is easiest, because the same operation is repeated dozens of times and sooner or later someone does it in a hurry.
Three lines in the client file are enough: which tool is used for group messages, whether it prevents addresses from being exposed or depends on who is writing, and when the people who send were last trained. If the second answer is 'it depends on who is writing', that is where the measure belongs.
Official source:Garante per la protezione dei dati personali — provvedimento n. 763 del 7 ottobre 2026 [doc. web 10309222]Official source:Federprivacy — PEC con gli indirizzi dei destinatari in chiaro: il Garante multa la Federazione degli Ordini dei BiologiLooking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
