Using Bcc and privacy: emailing a group of people who don't know each other
If you email your customers, members or the parents at a sports club all at once, you don't want everyone to see each other's email address. That's what the Bcc field is for. In this article you'll read when to use To, Cc or Bcc, why visible addresses can be a data breach, and how to email a group safely in webmail.
To, Cc and Bcc
| Field | For whom? | Who sees the address? |
|---|---|---|
| To | People who need to take action or from whom you expect a reply | All recipients |
| Cc (carbon copy) | People who are reading along but don't need to do anything | All recipients |
| Bcc (blind carbon copy) | People who get a copy the others aren't allowed to see | Nobody, not even the other Bcc recipients |
Bcc works because a mail server delivers to the addresses on the envelope, not to what's in the message itself. An address in Bcc does go on the envelope, but the Bcc header isn't included in the message the others receive.
Visible addresses can be a data breach
A person's email address, such as sanne@example.com, is personal data. If you send one email to forty customers using To or Cc, every customer gets the addresses of the thirty-nine others. They never gave permission for that.
The GDPR calls this a personal data breach (Article 4(12)): a breach of security that leads to, among other things, the unauthorised disclosure of personal data. In plain language: a data breach. Whether you need to report it to the supervisory authority (in the Netherlands, the Dutch Data Protection Authority) depends on the risk to the people concerned (Article 33). Forty addresses of a florist's customers are not the same as forty addresses of participants in a debt support group. In the second case, the mere fact that someone is on the list reveals something sensitive. If you're in doubt, document it and find out whether you need to report it. This is not legal advice.
How to email a group safely
- In webmail, click Compose.
- Put your own address in To. That way the email has a proper recipient and you get a copy yourself.
- Click the plus sign to the right of the To field and choose Bcc.
- Put all the other addresses in the Bcc field.
- Before you click Send, check one more time that there are no addresses in To or Cc that don't belong there.
A group from your address book
Have you created a group in your address book, such as Suppliers or Members? Then type the name of the group in the field, or choose it with the button with the people icon next to the field. Webmail then puts all addresses in the group in the field where you chose the group. If you choose the group in To, everyone in the group sees all the other addresses. So always choose a group of people who don't know each other in Bcc. How to create a group is explained in Creating groups.
Many recipients: the daily limit and a newsletter service
A mailbox is meant for personal email, not for newsletters. You can only send a limited number of emails per day, and that limit applies to your whole package combined: all mailboxes, webmail and your website. Every recipient counts, including those in Bcc. So one message with two hundred addresses in Bcc counts as two hundred emails. Read Limit for sending email.
If you regularly want to reach a large group, use a newsletter service. It takes care of unsubscribes and a clean list. A group in your address book has no unsubscribe button: if someone asks not to be emailed anymore, remove them from the group yourself. You can read more about this in the lesson Consent, unsubscribing and a clean list of the course Email in order.
Accidentally made all addresses visible anyway?
You can't recall an email once it's sent. Document what happened: which email, when and to whom. Then assess whether you need to report it. What a data breach is and how the notification obligation works is explained in the lesson Data breaches and the notification obligation of the course Safe online.
The steps in webmail are also described in the Roundcube guide under Writing a new message. You can find the text of the GDPR on EUR-Lex.