Using CC in Emails? Beware of Potential Privacy Violations, NPC Says

(SPOT.ph) If you're always sending emails, you've probably seen and even used the carbon copy (cc) function to keep others in the loop about an email thread. Did you know that this could entail security risks and data privacy concerns?

The National Privacy Commission (NPC) warned about such risks on Monday, August 7, pointing out that everyone who receives the email can see the other email addresses in the cc recipient field. This could result in “unintentional disclosure of personal information.”

Beyond open recipients, the use of cc can also unwittingly reveal personal, confidential, and restricted information within the email body. This heightens the risk of breach of confidentiality, data sharing, and other non-disclosure agreements, it said.

“We have observed the high number of human errors, specifically the inadvertent use of the cc function, as a cause of security incidents, which have risen in number since 2021. Such errors have led to unintended data exposure, potentially compromising the privacy and security of the data subjects involved,” NPC said in a statement.

Using the cc function unnecessarily can also be punishable under the Data Privacy Act (DPA) and other NPC issuances. In Chapter VIII Section 25 and 26 of the DPA, unauthorized access has a penalty of one to three years of imprisonment, while providing access due to negligence has a penalty of three years to six year of imprisonment. Both have a minimum fine of not less than P500,000.

Also read: GUIDE: Email and SMS Scams You Need to Know to Protect Your Money

How to use carbon copy responsibly

This doesn’t mean the cc function shouldn’t be used. After all, it's helpful in keeping multiple parties informed about specific projects and conversations without having to send numerous emails.

As such, NPC has issued the following reminders when using cc in email communications: 

• Double-check if the recipients of the email included in the cc function are necessary.
• Be mindful of the personal and sensitive personal information shared in emails and its attachments. Apply safeguards such as encryption, password protection, and secure file-sharing platforms in certain instances.
• Train employees to practice best practices in email correspondence.

NPC also advised the public to use blind carbon copy (bcc) function. It's a way of sending emails to multiple people without them knowing the email addresses of other recipinets, which adds a layer of protection from the risk of accidental data exposure.

Also read: Please Don't Call or Email Me on My Vacation Leave, Thank You