The receipt, use, and deletion by an employer of personal data relating to an employee's private life, even if obtained through a third party, constitute processing of personal data subject to the GDPR and require a valid legal basis.

Facts and context

The Hellenic Data Protection Authority issued a decision issuing a warning against the company "AMERICAN COMPUTERS & ENGINEERS HELLAS SOCIÉTÉ ANONYME TECHNIQUE, COMMERCIALE ET INFORMATIQUE" for breaches related to the lawfulness of processing data of a former employee.

The case originated from a complaint by a former employee, A, and another person, B, regarding the employer's use of a screenshot of their private conversation. During a remote presentation via the "Any Desk" application from her work computer, the employee did not disconnect, allowing a potential client, Γ, to capture a private conversation held on the "Messenger" application and send it by email to the company's management. The employment relationship ended the day after receiving this email.

Reasons for the decision

The authority found a single breach against the company:

• Obligation of lawfulness of processing (Article 5(1)(a) of the GDPR): The authority first qualified as processing operations the receipt of the email containing the photograph of the private conversation, its use to assess the employee's compliance with professional obligations, then its deletion. It dismissed the company's argument that these operations were not subject to the GDPR. The authority then found that the company, as the controller, did not invoke any valid legal basis, within the meaning of Article 6 of the GDPR, to justify these processing operations. Furthermore, it noted a lack of fairness and transparency, as the employee was not informed before the definitive deletion of the email concerning her, which was also considered a component of the violation of the lawfulness principle, in light of the accountability obligation provided for in Article 5(2) of the GDPR.

Authority's decision

Consequently, the authority issued a warning to the company "AMERICAN COMPUTERS & ENGINEERS HELLAS SOCIÉTÉ ANONYME TECHNIQUE, COMMERCIALE ET INFORMATIQUE" under Article 58(2)(b) of the GDPR.

To determine the corrective measure, the authority took into account several factors, including the isolated nature of the incident, the absence of prior sanctions, the absence of intentional fault or demonstrated economic damage, as well as the negligence of the employee who did not close the screen-sharing application.

Lessons learned

This decision reminds that:

• The mere receipt of personal data by an employer, their consultation, then their deletion constitute processing operations that must be based on a valid legal basis, even if these data were obtained unexpectedly from a third party.
• A controller cannot evade its obligations by denying the qualification of personal data or the existence of processing, especially when these data are used to make decisions affecting the data subject, such as terminating an employment relationship.
• The principle of fair and transparent processing implies informing the data subject before deleting data concerning them, particularly when such data were obtained from a third party and could constitute evidence in a potential dispute.