On Tuesday, August 12, 2025, the City of Duvall sent a courtesy email to approximately 1,200 utility customers reminding them to re-enroll in credit card automatic payments following a recent system upgrade.
Unfortunately, the email was sent using the “CC” field instead of the “Blind CC” field, making all recipient email addresses visible to other recipients. This was an error, as our standard practice is to use “Blind CC” to keep email addresses private.
No other personal information was shared, and there has been no breach in the security of the City’s utility account system. The City has contacted all affected customers to inform them of the error and has implemented new procedures to ensure email addresses are always hidden in future communications.
According to the Washington State Office of the Attorney General and Washington’s Data Breach Notification Laws, an email address alone does not meet the definition of “Personal Information” that requires a formal data breach notice. We have confirmed this guidance with our City Attorney. You can read more about the law here: https://www.atg.wa.gov/washington-s-data-breach-notification-laws
The City of Duvall takes customer privacy seriously and apologizes for this error.