Confidentiality and Negligence: From a Group Email to a High-Speed Train, Two Recent Examples of Poorly Protected Data

What are we talking about?

Two recent incidents raise questions about the effective integration of the GDPR into companies’ day-to-day practices.

On 21 August 2025, a passenger on a high-speed TGV train overheard a telephone conversation between two HR managers openly discussing the imminent dismissal of an employee. The conversation even referred to finding a “reason” that could be used to justify the dismissal.

On 11 September 2025, an HR manager at a company recruiting an employee on a fixed-term contract sent a group rejection email to 340 applicants after forgetting to use the “BCC” field.

One click, one conversation… and the data leaks

There is no doubt that both situations fall within the scope of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the “GDPR”).

Indeed, the concept of “personal data” is defined in Article 4(1) of the GDPR and comprises four cumulative elements:

• “any information”;
• “relating to”;
• “a natural person”;
• who is “identified or identifiable”.

The concept of “any information” is deliberately very broad and includes:

• Objective information, such as a characteristic of a person (surname, first name) or a fact (place of work);
• Subjective information, such as an opinion, assessment or evaluation, including a manager’s comment or a positive or negative appraisal.

The format in which the information is communicated is irrelevant, as oral information may, depending on the circumstances, also qualify as personal data.

Nor is it necessary for the information to be accurate, verified or complete.

Although the qualification of information as personal data always depends on the context and must be assessed on a case-by-case basis, names, surnames, email addresses and information linking an identifiable individual to a workplace unquestionably fall within the scope of the GDPR.

Accordingly, the information overheard and seen on the train that made it possible to identify the employee, as well as the email addresses through which the 340 applicants could be identified, fall within this definition.

Everyday mistakes with serious consequences for the data controller

Sending a rejection email to 340 applicants with all recipients visible exposed their email addresses to every other recipient.

Likewise, discussing an imminent dismissal while mentioning an employee’s first and/or last name, together with the name of the company, and leaving professional information visible on a laptop in a public place such as a train amounts to exposing personal data to unauthorised third parties.

In both cases, the companies, acting as data controllers, are subject to the principle laid down in Article 5(1)(f) of the GDPR, namely the principle of integrity and confidentiality.

This principle requires personal data to be processed in a manner that ensures appropriate security, using appropriate technical or organisational measures, including protection against unauthorised or unlawful processing and against accidental loss.

Article 32 of the GDPR further specifies this obligation by requiring the implementation of measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services.

In the event of a personal data breach, as may be the case here, Article 33 of the GDPR requires the competent supervisory authority to be notified without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of the individuals concerned.

Recital 85 of the GDPR highlights that the purpose of such notification is to limit the harm suffered by individuals, which may include damage to reputation, loss of confidentiality of personal data protected by professional secrecy, or other significant economic or social disadvantages.

Although other GDPR principles may also apply and potentially lead to sanctions, it appears clear that an investigation by a supervisory authority could reveal shortcomings in the internal measures implemented by the companies concerned.

Lastly, depending on the nature of the infringements, Article 83 of the GDPR provides for administrative fines of up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover, whichever is higher.

Indirect consequences may be just as significant, including serious reputational damage, loss of trust among employees and other stakeholders, and potential legal proceedings.

Prevention is better than cure: good GDPR practices for businesses

These two incidents demonstrate that protecting personal data depends first and foremost on simple, practical and consistently applied day-to-day measures.

Key measures include:

• Training and raising employees’ awareness of the correct use of IT tools, particularly email, the importance of confidentiality in internal and external communications, and the risks associated with GDPR breaches;
• Implementing an internal personal data policy and strict confidentiality rules for all sensitive communications, whether during meetings, business travel, telephone calls or remote working;
• Regulating the use of IT equipment, including by providing appropriate tools that strengthen confidentiality and encourage good communication practices;
• Implementing and regularly updating internal policies and incident-management procedures, including internal reporting, risk assessments for affected individuals, documentation and, where necessary, notification to the CNPD within 72 hours;
• Protecting data processing activities through effective technical measures, including IT security, and organisational measures such as procedures and internal controls;
• Clearly informing internal and external data subjects about how their personal data is protected and ensuring that they can effectively exercise their rights, including access, rectification, erasure and objection.

GDPR compliance is not a standardised checklist. Supervisory authorities can quickly identify generic approaches that do not reflect the actual needs and practices of a business.

Compliance measures are not one-size-fits-all and must be adapted to the specific circumstances of each organisation, taking into account its size, sector, the nature of the data it processes and its internal practices.

We assist our clients in implementing these measures and remain available to discuss their specific needs.

 

➡️ For any questions relating to IP/IT matters or, more specifically, data protection, please contact Mathilde Wazana Moock or Nicolas Thieltgen.