The Italian data protection authority sanctioned a company for late response to an access request and for its policy on managing employees' email accounts after termination of their employment contract.

Facts and context

The Italian data protection authority (Garante per la Protezione dei Dati Personali - GPDP) issued a sanction decision against Techpartner s.r.l. for breaches related to handling a data subject rights request and processing employees' email accounts. The amount of the fine was not published.

The case originated from a complaint by a former employee dated October 11, 2023, concerning an unsatisfactory response to his access request to his personal data, as well as other allegations that were not upheld by the authority.

Grounds for the decision

• Obligation to respond to an access request within deadlines (Article 12, paragraph 3, of the GDPR and Article 15 of the GDPR): The company did not provide the data requested by the complainant within one month. It justified the delay by difficulty identifying the access request within broader correspondence related to labor law, and difficulties retrieving documents prior to 2020 following a merger. The authority rejected these arguments, emphasizing that the request explicitly referred to data protection legislation and the European Data Protection Board (EDPB) Guidelines 1/2022 on the right of access. Furthermore, the complexity of the search should have led the company to inform the complainant of a two-month extension as allowed by Article 12, paragraph 3, of the GDPR, which it did not do.
• Obligation of lawfulness, data minimization, and storage limitation (Article 5, paragraph 1, points a), c) and e) of the GDPR): The investigation revealed that the company's internal policy provided for keeping an employee's email account active up to 6 months after departure and allowing reading its content to ensure business continuity. The authority found this practice contrary to the principles of lawfulness, minimization, and storage limitation, recalling that electronic correspondence is protected by confidentiality guarantees. It specified that business continuity must be ensured by appropriate document management systems and not by retaining email accounts, which do not provide the required guarantees of authenticity, integrity, and reliability. The compliant procedure consists of disabling the account and setting up an automatic reply informing third parties of an alternative address, without allowing the employer to view incoming messages.

Authority's decision

Consequently, the authority imposed a sanction on Techpartner s.r.l., with a fine of €25,500.

Lessons learned

This decision reminds that:

• A data subject rights request is valid and must be processed within deadlines, even if embedded within broader communication on other subjects, as long as it is clearly identifiable.
• Internal organizational difficulties, such as a company merger, do not justify a delay in responding to an access request; the data controller must use the GDPR's deadline extension mechanisms by informing the data subject.
• Business continuity cannot justify retaining and accessing a former employee's email account; document management systems must be implemented to archive relevant professional information during the employment relationship.