Anonymised respondents (Companies A and B)
No offence disclosed; closed under section 6. DPO, September 2024.
The facts
A shareholder complained that a meeting invitation for Company A's shareholders was emailed to all shareholders collectively instead of individually. Company B, as controller for Company A, acknowledged the breach was unintentional: on 29 August 2024 an employee emailed all of Company A's investors, revealing their email addresses and in some cases names and surnames. The companies reported the breach, described preventive measures, and told the Commission they were satisfied with the measures implemented.
Orders and outcome
The Data Protection Commissioner decided that the enquiry had not disclosed the commission of an offence under the DPA and closed it to the satisfaction of all parties.
Cite this decision
Track Mauritius enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.