Sending an email to multiple recipients while leaving their addresses visible constitutes an unauthorized communication of personal data, violating the principles of lawfulness and data minimization, even in the absence of malicious intent and when the data are not sensitive.

Facts and context

The Italian data protection authority (Garante) has today published a sanction decision against the National Federation of Biologists' Orders (FNOB) (including the imposition of a €2,000 fine) for breaches related to the unauthorized communication of email addresses.

The case originated from a complaint by a biologist who received, on two occasions on July 21 and 24, 2025, emails from the Federation in which all recipients were visible.

Reasons for the decision

The authority found that the Federation, by sending collective emails without masking the recipients' addresses, carried out a communication of personal data without a legal basis and in violation of the fundamental principles of the GDPR.

• Obligation of lawfulness, fairness and transparency (Article 5(1)(a) of the GDPR): The authority recalls its consistent position, notably established in its 2013 guidelines, that sending an electronic message with a visible distribution list constitutes a communication of personal data (email addresses) to third parties (other recipients). In this case, each recipient became aware of the email addresses of the others. This communication, although resulting from a material error, was carried out unlawfully and non-transparently towards the data subjects.

• Obligation to have a legal basis for processing (Article 6 of the GDPR): Processing of data by a public body is lawful only if necessary for the performance of a legal obligation or a task carried out in the public interest. The authority emphasizes that, according to recital 41 of the GDPR, the legal basis for such processing must be clear, precise and foreseeable for the data subjects. However, no legal or regulatory provision authorized the Federation to communicate the email addresses of its members to each other. The contested communication was therefore not based on any valid legal basis within the meaning of Articles 6(1)(c) and (e) of the GDPR and Article 2-ter of the Italian Data Protection Code.

Authority's decision

Consequently, the authority imposed a fine of €2,000 on the National Federation of Biologists' Orders.

Furthermore, the authority ordered the publication of its decision on its website, due to the large number of recipients concerned by the communication.

Lessons learned

This decision reminds that:

• Sending a collective email with recipients' addresses visible in the "To" or "Cc" field constitutes a communication of personal data to third parties, and not a mere manipulation error.

• Such communication of data, even if resulting from human error, must be based on a valid legal basis within the meaning of Article 6 of the GDPR, which is rarely the case for disclosing a list of recipients.

• Simple human error is not an exonerating excuse; data controllers must implement technical and organizational measures (such as distribution lists or training on the use of the "Bcc" field) to prevent this common type of incident.