P2019-ND-021

On April 2, 2018, an employee of the Organization received an online loan application for a potential new member. The employee forwarded the email containing the application to the Branch Manager for review and action. However, Microsoft Outlook auto-populated the name of the last person the employee emailed who was not authorized to receive the information and was outside of the Organization?s network. The employee discovered the incident the same day, immediately after sending the email. The information was disclosed to one individual who is an existing and current member of the Organization.