The data controller must ensure an appropriate level of security for the processing of personal data when personal data is sent via e-mail. In view of the inherent risks of handling personal data by e-mail (that the e-mail may end up in the wrong hands), sensitive personal data should never be sent via unprotected e-mail. Sensitive information such as health information or privacy-sensitive information such as social security numbers and salary information should be transmitted more securely than via unprotected e-mail, for example via a portal where the recipient can log in to see the information or that the information is encrypted during the transfer.