The Greek DPA held that sending bulk emails with all recipients' email addresses entered in the "To" field is not compliant with Article 32 of the GDPR. It recommended the use of BCC as an alternative.