When an employee leaves, it is often a first step for the business that his personal access to their professional mailbox is cancelled as soon as possible (often even during the exit meeting). But most often that mailbox will remain open for quite some time after the termination, as there is a genuine business concern that e-mails may still come in after the termination that are of entirely legitimate interest to the company, such as in relation to orders or ongoing matters requiring to be picked up by someone else.
An increasing number of employees appear to be concerned by this practice, and request that their former professional e-mail address be cancelled immediately. Such requests are noted by the employer but (deliberately or otherwise) aren’t always followed up too diligently, as demonstrated by a couple of recent decisions of the Litigation Chamber of the Belgian Data Protection Authority (DPA). These cases have allowed the DPA to refine its position on the matter and its conclusions and resulting guidelines, as summarised below, should be of interest to all companies with employees and consultants in Belgium.
With respect to the e-mail address and mailbox of a former employee or consultant, the Belgian DPA considers the following:
In the cases brought before the Litigation Chamber, the Chamber ruled that the principles of the GDPR, as translated in the above guidelines, had manifestly not been complied with. The sanctions applied by the Chamber however remain relatively lenient: a reprimand, combined in one case with an administrative fine of 15,000 EUR. This may be because, with due respect to the DPA, some of these points are perhaps a counsel of perfection, viable in theory but unlikely to survive their first encounter with the reality of a contentious exit of a resentful or antagonised senior executive or large scale terminations. There must be some flexibility in the sanction to reflect the presence or absence of actual harm to the ex-employee, any mitigating concerns the employer may have around competition, the administrative burden which weeding through multiple mailboxes will impose, the difficulties of doing that weeding pre-termination in a case where the dismissal or resignation is with immediate effect, and what happens when the departing employee refuses to trust (perhaps with good reason) the person of trust. It must be hoped that the key for an employer will be to be seen to do its best – these procedures are guidelines, not law, and so breaches of them may add substance to claims for breaches of individual rights but should not amount to free-standing claims by themselves.
The decisions of the Chamber emphasize the importance of a dedicated section in the IT policy on the fate of the work mailbox after an employee leaves the company. While they are still in service, employees should be informed why their employer may want to have access to their mailbox after they have left the company, how long their mailbox will remain open after their departure, what message will be communicated to correspondents, and who will be the “person of trust” sifting through their e-mails. The level of information received will determine the employee’s reasonable expectations of privacy and ensures compliance with the GDPR’s information obligation towards data subjects. On the basis of the guidance in these decisions, some companies will also have to rethink their policies around data retention and keeping mailboxes open without limitation. The development of a uniform policy in this respect will require consideration also of the views of the other EU national data protection authorities, as they aren’t yet fully aligned on the topic. It is expected that attention to this matter will grow, both from the authorities and data subjects. In other words, it may not be possible to develop a single EU-wide policy on this.
As an outro, the decisions of the Chamber remind us that in privacy matters, people in glass houses should not throw stones. One case had come before the Chamber following a complaint from an individual who had unsubscribed from a commercial mailing list but continued to receive unwanted newsletters. The inspection service of the DPA discovered that he received these e-mails not as an original recipient, but because the newsletters were being automatically forwarded to him from the mailbox of a former colleague who had left the company months before.… Snap.
Copyright Squire Patton Boggs.
The opinions expressed in this update are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.