# New ICO guidance on sending bulk emails published

- Link: https://fundraising.co.uk/2023/09/04/new-ico-guidance-on-sending-bulk-emails-published/
- Published: 2023-09-04T13:33:35+01:00
- Author: Melanie May

**Charities have been warned by the Information Commissioner’s Office to use alternatives
to the BCC email function when sending communications including sensitive personal
information.**

The warming follows what the ICO calls ‘a catalogue of business blunders’ and the
publication of [new guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/email-and-security/).

The ICO says the charity sector is the fifth biggest offender for BCC breaches, 
with education first, health second, local government third and retail fourth, and
highlights some recent cases. Last month it [reprimanded two Northern Irish organisations](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/08/ico-warns-of-email-data-breach-risk-as-it-issues-two-reprimands/)(
not charities) for disclosing people’s information inappropriately via email. And
in March the ICO [issued a reprimand to NHS Highland](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/03/ico-calls-for-highest-standards-in-hiv-services-after-nhs-highland-reprimand/)
for a “serious breach of trust” after a data breach involving those likely to be
accessing HIV services. 

## Advertisement

According to ICO data, failure to use BCC correctly is consistently within the top
10 non-cyber breaches, with nearly a thousand reported since 2019. 

#### ICO guidance

Under data protection law, organisations must have appropriate technical and organisational
measures in place to ensure personal information is kept safe and isn’t inappropriately
disclosed to others. 

The ICO says that organisations using and sharing large amounts of data, including
sensitive personal information, should consider other secure means to send communications,
such as bulk email services, mail merge, or secure data transfer services, so information
is not shared with people by mistake.  

Organisations should also consider having appropriate policies in place and training
for staff in relation to email communications.  

For non-sensitive communications, it says organisations that use BCC should do so
carefully to ensure personal email addresses are not shared inappropriately with
other customers, clients, or other organisations. 

Mihaela Jembei, ICO Director of Regulatory Cyber, said: 

> “Failure to use BCC correctly in emails is one of the top data breaches reported
> to us every year – and these breaches can cause real harm, especially where sensitive
> personal information is involved.
>  
> “While BCC can be a useful function, it’s not enough on its own to properly protect
> people’s personal information. We’re asking organisations to assess the nature
> of the information and the potential security risks when deciding on the best 
> method to communicate with staff or customers. If organisations are sending any
> sensitive personal information electronically, they should use alternatives to
> BCC, such as bulk email services, mail merge, or secure data transfer services.
>  
> “This new guidance is part of our commitment to help organisations get email security
> right. However, where we see negligent behaviour that puts people at risk of harm,
> we will not hesitate to use the full suite of enforcement tools available to us.”