Collection agency sent a "Final Demand" email but CC’d 20+ random strangers. Is this a Data Privacy breach? What are my options?

Hey everyone, looking for some advice on a severe privacy issue I just encountered.

​I have an outstanding loan with SB Finance. Today, I received a "FINAL FOLLOW UP PAYMENT" email from an accredited collection agency acting on their behalf.

​To my shock, instead of sending it directly to me or using BCC, the agency put my email address and over 20 other completely random Gmail/Yahoo addresses in the open CC (Carbon Copy) field.

​Because they did this:

​Over 20 strangers now have my personal email address.

​These strangers now explicitly know that I am being chased for a loan/payment follow-up.

​People on the thread are already hitting "Reply All" asking why they were included, which is just making the email chain longer and exposing my situation even further.

​I know I owe a valid debt and I intend to settle it, but this feels like a massive violation of my rights. Is this a clear breach of the Data Privacy Act (RA 10173) and SEC rules on unfair debt collection?

​Has anyone experienced this with SB Finance or their third-party collectors? How did you handle it, and can I use this as leverage to negotiate a waiver of penalties/interest with the bank?

​Appreciate any advice on how to formally complain to the NPC or SEC about this. Thanks!