Prepare the notification to the Dutch data protection authority

Summary

A service desk colleague exported the ticket history of one customer to a spreadsheet and mailed it to the wrong recipient, an address at another customer with a similar name. A reply from the other customer brought the mistake to light.

Impact

The export lists customer contacts with names, email addresses, and ticket descriptions, some of which mention the customer's own staff. About two hundred people appear in it. The unintended recipient is a business customer, and has said the message was read by one person.

Response

The sender asked the recipient to delete the message and the attachment, and the recipient confirmed the deletion in writing. The mail was recalled where possible, and the mailbox rules that suggested the wrong address were removed.

Notifications

The Data Protection Officer, Ilse Wiegman, is preparing the notification to the Dutch data protection authority and the message to the customer concerned. The deadline of 72 hours from awareness is on the breach clock of this Incident.