body: Some Co-workers of mine have been sending customer's personal information, that includes banking details through unsecured plaintext emails. This feels to me like it is definitely breaking laws/regulations but I am not sure what ones. This is going on in the US and in the UK
  
  
  Is this an illegal practice?
  
  
  EDIT: 
  By unsecured email I just mean a normal email sent between employees over outlook, this is also used to send emails externally and there is no blocker for sending attachments to external emails if someone was to mistype an email address there is nothing to stop this being sent out.
  
  
  By Plaintext I mean what is sent and received is readable, no hashing, etc. I don't know if this is encrypted decrypted on the send but as the email can be sent externally and internally I doubt it
  
  
  
title: Data Protection Laws