Data protection-compliant handling of employee emails

An important topic that has so far hardly been dealt with in judicature refers to the forwarding of emails from permanently or temporarily absent employees. For the first time, the Austrian Data Protection Authority (DPA) now had the opportunity to specify the relevant legal framework.

The case

This case was about an employee who was given two email addresses for work purposes, which he was also allowed to use privately. After the employee had left the company, incoming emails were forwarded from his former mailbox to an internal company email address in order to ensure a quick response to customer inquiries. Then, it turned out that the employee had violated a post-contractual non-compete clause. These emails were subsequently printed out and used as evidence before the Labor and Social Court. The former employee in turn filed a complaint against this with the Data Protection Authority.

The right to confidentiality is not absolute

The forwarding of (also) private emails from an employee after the termination of their employment interferes with the right to confidentiality. However, this (fundamental) right is not absolute, but can be restricted. Restrictions on the right to confidentiality are permissible in accordance with the grounds given in the GDPR, for example to protect the overriding legitimate interests of another party or with the consent of the person concerned. The latter were relevant in this case.

Overriding legitimate interest in forwarding the emails

The DPA basically confirmed the employer’s legitimate interest in receiving and opening emails from his former employee to enable an undisturbed business process. This was all the more true since the employee was in charge of a specialist department, was in direct contact with customers and therefore customer inquiries were to be expected via his or her account.

The DPA also took into account that the former employee was informed in advance of the forwarding of his emails in the event of his departure and therefore had to expect such processing of his or her data.

Although the employee was allowed to use his work email address privately, the employer also took this circumstance into account insofar as he only inspected emails after checking the subject and sender to make sure that an official context of a respective email was to be assumed.

Overall, therefore, the weighing of interests turned out to be in favor of the employer.

The fact that the forwarding only took place to the two managing directors and one other employee, that the measure was of limited duration, that it was only started when the employee had left and that private emails were sorted out as described, which would also have spoken for the proportionality of the intervention, was not considered separately by the DPA.

Revocation is not possible without further ado

It should be noted that if the employer does not base the legality – as in the present case – on mere consent, but on overriding interests, the data processing cannot be objected to without further ado. Rather, the employee would have to assert and prove that reasons arising from his or her particular situation stand in the way of data processing.

Conclusion

In summary, an employer may have an overriding interest in forwarding emails after the employee has left the company. However, in the event of a dispute, these will be put to the test and weighed against the interests of the employee. The employer should therefore ideally assess the need for forwarding in advance and communicate such measures transparently to his or her staff.

Our experts from the Data Protection team will be happy to answer any further questions you may have on this topic.

Disclaimer

This article is for general information only and does not replace legal advice. Haslinger/Nagele Rechtsanwälte GmbH assumes no liability for the content and correctness of this article.

 

1. July 2021

 

---

Go back to News