Access to resigned employee's email not allowed for defence in court - why employers should review their policies

At a glance

• On 15 March 2023, the Data Protection Authority, in a press release stated that an employer may not access the email of an employee who has resigned, even if the data collected is necessary for evidential purposes in court.
• A recent case dealt with by the Data Protection Authority reinforces why employers should review their policies concerning accessing employee emails upon termination.

Following the press release by the Data Protection Authority (DPA) on 15 March 2023, the DPA re-affirmed its position by sanctioning an employer who, after the termination of an employment relationship, kept the former employee's e-mail account active, viewing its content and set up a forwarding system to another employee at the company. 

Summary of the case

An employee, prior to completing her employment relationship with the company, collected on behalf of the employer information and references from potential customers she had met on a trade show. The subsequent attempt at contacting the individuals on behalf of the company resulted in court litigation. The company, to avoid jeopardising their relationship with potential customers, not only wrote to the individuals making them aware the employee had been terminated but had also viewed the content of the communications between the employee and the potential customers.

However, the DPA held that, neither the need to maintain customer relations nor interest in defending one's right in court could legitimize such processing of personal data. In order to achieve a balancing of the interests at stake (the need for the continuation of the owner's economic activity and the data subject's right to privacy), it would have been sufficient to activate an automatic response system, with the indication of alternative addresses to be contacted, without viewing incoming communications on the account.

Key takeaways

It is very common for employers to lose sight of the data privacy implications when it concerns managing employee email accounts when employees are no longer in the business. Therefore, we recommend reviewing, implementing and creating policies which clearly set out how employee data and personal accounts are to be handled upon termination of a contract.

If you require further assistance, please contact our team who can assist you in creating policies to ensure the best protection for your company.