Premature deletion of data by an employer, despite a warning from an employee about the existence of legal claims, constitutes a violation of multiple GDPR principles, notably the right of access and the obligation to retain data necessary for the defense of rights in legal proceedings.

Facts and Context

The Hellenic Data Protection Authority issued a sanction decision against SERVICE 800 TELEPERFORMANCE SOCIÉTÉ ANONYME UNIPERSONNELLE DE PRESTATION DE SERVICES (TELEPERFORMANCE GREECE), including a total fine of €100,000, for breaches related to handling an access request and deletion of data of a former employee in a pre-litigation context.

The case originated from two complaints by a former employee accusing his ex-employer of failing to satisfy his access request, notably by deleting professional emails essential to his legal actions, despite his explicit request not to erase them.

Reasons for the Decision

The authority found several GDPR breaches based on the analysis of facts and parties' arguments:

• Obligation of lawfulness, fairness, transparency, integrity, and respect for the right of access and the erasure exception (Articles 5(1)(a) and (f), 15 and 17(3)(e) of the GDPR): The authority found that the company deleted the complainant's emails and professional account on June 4, 2025, before the end of his contract (June 30, 2025) and after he explicitly requested on May 7, 2025, the retention of data related to his internal reports of psychological violence. By acting thus while legal claims were ongoing, the company not only made it impossible to fully satisfy the access request of June 16, 2025, but also violated the obligation to retain data necessary for the establishment, exercise, or defense of rights in court.
• Obligation of transparency and respect for modalities of exercising rights (Article 12(3) of the GDPR): The company notified the complainant of a two-month extension of the response deadline to his access request. However, it did not provide the reasons justifying this extension, as required by this provision, thus failing its obligation to process the request transparently.
• Obligation of information (Articles 13 and 5(1)(a) of the GDPR): The authority noted that the company did not properly inform the complainant about the data retention period, the hyperlink provided for this purpose in the documentation being non-functional. This breach contravenes the transparency principle and the specific information requirements for data subjects.
• Obligation of security of processing (Article 32 of the GDPR): The authority considered that the company did not implement appropriate technical and organizational measures to ensure data availability and access. Applying a general deletion policy without providing an exception procedure to suspend erasure in case of dispute or justified retention request constitutes an organizational failure.
• Accountability principle (Article 5(2) of the GDPR): By committing all the aforementioned violations, the company failed its general accountability obligation, which requires ensuring GDPR compliance and being able to demonstrate it.

Authority's Decision

Consequently, the authority imposed a fine of €100,000 on SERVICE 800 TELEPERFORMANCE SOCIÉTÉ ANONYME UNIPERSONNELLE DE PRESTATION DE SERVICES (TELEPERFORMANCE GREECE), broken down into a €60,000 fine for violations of Articles 5(1)(a) and (f), 15 and 17(3)(e), and a €40,000 fine for violations of Articles 5(2), 12(3), 13 and 32 of the GDPR.

Lessons Learned

This decision reminds that:

• An automatic data deletion policy for employees leaving the company must imperatively include a suspension mechanism ("legal hold") as soon as the data controller is informed of the existence of legal claims or a potential dispute requiring retention of such data as evidence.
• A data controller cannot claim the impossibility to respond to an access request when this impossibility results from data deletion it performed itself after being warned of their necessity for exercising rights in court.
• The justification for extending the response deadline to a rights exercise request, provided for in Article 12(3) of the GDPR, is not a mere formality but a transparency obligation whose non-compliance constitutes a distinct breach.