Illicitly processing the data of two former employees cost a Piacenza company very dearly. On March 25, 2022, two former employees of a repair center filed a complaint alleging violations of the Regulation (GDPR) and in particular the “continuing activity of individual company accounts for several months beyond the termination of employment relationships, with simultaneous access to messages received therein”. Furthermore, they complained about the impossibility of exercising the right of access to the content of the aforementioned accounts due to the deletion of their contents. Furthermore, according to the complainants, the company did not provide them with adequate information regarding the processing of data relating to e-mail.
The investigation ascertained, indeed, that after the termination of the employment relationship the Data Controller kept active, for a few months, the individualized email accounts assigned to the complainants; the same accounts were accessed, in that period of time, by the president of the board of directors, legal representative of the Company, “in order to guarantee the operational continuity of the company, given the relevance of the corporate communications received, also taking into account the top role played by former employees”.
When issuing the provision dated 7 March 2024, the Authority reiterated that the exchange of electronic correspondence on an individualized company account – whether or not unrelated to work – constitutes an operation that allows knowledge of some personal information relating to the interested party. Stating, however, that the legal representative would have limited himself to seeking particularly important communications for business continuity – without viewing the others – is not sufficient to make the data processing lawful. In fact, the search for communications that the Company considered relevant always took place after accessing all the messages contained in the mailboxes. In this regard, the Guarantor specifies that even the external data of the communications themselves and the attached files, in addition to the content of the e-mail messages, concern forms of correspondence supported by guarantees of secrecy also protected constitutionally (articles 2 and 15 of the Constitution).
It would have been lawful, however, to limit oneself to maintaining the accounts assigned to the complainants, at the same time activating an automatic response message aimed at informing third parties of the imminent deactivation of the accounts and the possibility of contacting other and different e-mail addresses, and this only for a time proportionate to the needs of continuity of the activity carried out by the Company. Suitable measures should also have been adopted to prevent access to incoming messages and their viewing during the period in which this automatic system was in operation (Indications reiterated several times by the Guarantor: See, among others, doc. web no. 9978536; web doc. no. 8159221, point 3.4).
The Authority therefore imposed an administrative sanction on the Data Controller since the latter kept the individualized company email accounts active following the termination of the employment relationship, accessing their contents. The illicit processing operation, among other things, led to a fine of twenty thousand euros, with the right to settle the dispute by paying, within the deadlines, an amount equal to half of the same. [Provvedimento del 7 marzo 2024 [10009004], Register of measures n. 140 of 7 March 2024].
