This decision concerns the retention of former employees' email accounts for legal defense purposes, specifically regarding the lack of specific information provided to the data subjects and the absence of automatic reply messages.

Facts and context

The Italian data protection authority (GPDP) issued a decision against Michael Page International Italia s.r.l. for failures related to the management of former employees' email accounts after the termination of their employment contracts.

The case originated from three complaints filed by former employees who accused the company of keeping their email accounts active after their departure without informing them and requested their deletion.

Grounds for the decision

The company justified the retention of email accounts, after their deactivation, by the need to collect evidence in legal proceedings for unfair competition and misappropriation of trade secrets against the complainants and their new employer. It invoked its legitimate interest to defend its rights in court, pursuant to Article 6(1)(f) of the GDPR, and argued that this possibility was provided for in the information notice given to employees and in the internal regulations on the use of IT systems. However, the authority found several breaches:

• Obligation of lawfulness, fairness and transparency (Article 5(1)(a) of the GDPR): The authority considered the processing unlawful and unfair because the company did not implement an automatic reply message informing third parties of the employee's cessation of activity. The company deliberately omitted this measure to avoid alerting former employees about the evidence collection, which was deemed a circumvention of data protection principles to the detriment of the rights and freedoms of the data subjects.

• Information obligation (Article 13 of the GDPR): The authority found that the information notice provided to employees was insufficient. Although it mentioned the possibility of processing data for the defense of rights in court, it did not specify the specific modalities of retention and access to the email accounts after the end of the employment contract, nor the applicable retention periods in this context, thus failing its transparency duty.

Authority's decision

Consequently, the authority imposed a fine of €40,000 on Michael Page International Italia s.r.l.

Furthermore, the authority ordered the company to define distinct retention periods for former employees' email data kept for legal defense purposes and to update its information notice for employees to include precise details on these post-contractual processing activities.

Lessons learned

This decision reminds that:

• Retention of a former employee's email for defending rights in court must be specifically provided for and detailed in the information policy intended for employees, including retention periods.

• The deliberate absence of an automatic reply message on a departed employee's email, aimed at collecting evidence without their knowledge, constitutes unfair and unlawful processing.

• An employer's legitimate interest in defending itself in court cannot justify derogating from the fundamental principles of transparency and fairness in the processing of personal data.