A company was sanctioned for keeping active and redirecting former employees' email accounts after their departure, the authority considering this processing unlawful in the absence of a valid legal basis and recalling that consent generally does not constitute an appropriate legal basis in the context of an employment relationship due to the imbalance of power.

Facts and context

The Italian data protection authority (GPDP) issued a sanction decision against Top Secret Investigazioni e Sicurezza s.r.l. for breaches related to the management of former employees' email accounts after the termination of their employment contract.

The case originated from a complaint by two former employees regarding the retention of their email accounts after their departure, the redirection of received messages, and the lack of adequate information about this processing.

Reasons for the decision

The authority first rejected the company's argument that the procedure was flawed due to exceeding the 120-day deadline. It recalled, relying on the case law of the Italian Court of Cassation, that this deadline only runs from the end of the investigation phase, i.e., when the authority has not only collected but also fully assessed the elements characterizing a violation.

On the merits, the following breaches were found:

• Obligation of lawfulness, data minimization, and storage limitation (Article 5(1)(a), (c) and (e) of the GDPR): The authority found that the company had kept the complainants' individual email accounts active and redirected incoming emails for about eight months after the termination of their employment contract. It ruled that the former employees' consent, invoked by the company, could not constitute a valid legal basis due to the inherent imbalance in the employment relationship, citing Recital 43 of the GDPR, Opinion 2/2017 of the Article 29 Working Party (WP 249), and the European Data Protection Board's Guidelines on consent (WP 259). In the absence of any other demonstrated legitimate purpose, this processing was found contrary to the principles of lawfulness, data minimization, and storage limitation.
• Obligation of transparency and information (Article 13 of the GDPR): The authority considered that the information provided to employees at the time of hiring, as well as the internal regulations posted on the premises, were not sufficiently clear and complete to inform the data subjects about the processing of their data after the end of the employment relationship, notably regarding the management of their email account.

Authority's decision

Consequently, the authority imposed a fine of €10,000 on Top Secret Investigazioni e Sicurezza s.r.l.

Furthermore, the authority ordered the company to bring its personal data processing procedures for employees into compliance with the GDPR, particularly concerning the management of email accounts after the end of the employment contract.

Lessons learned

This decision reminds that:

• Maintaining a former employee's email account, even with a redirection system, constitutes personal data processing that must be based on a valid legal basis and comply with the GDPR principles.
• Consent generally does not constitute an appropriate legal basis for employee data processing due to the imbalance in the contractual relationship.
• Procedures for deactivating former employees' email accounts must be clearly defined and time-limited; an acceptable practice is to set up an automatic reply for a limited duration, informing senders of the person's departure and providing an alternative contact address, without allowing access to incoming messages.