Subjects
Annual Updates Subcategories
Anti-Bribery & Compliance
Anti-Trust & Competition
Collective Agreements
Data Protection & Privacy Subcategories
Disputes and Grievances
Employment Law
Employment Records
Employment Rights Act 2025
Employment Status Subcategories
Equality, Diversity and Equal Rights Subcategories
EU Legislation
Industrial & Workplace Relations Subcategories
International Mobility Subcategories
Parental Leave
Pensions & Benefits
Protection of Business Interests Subcategories
Recruitment, Termination of Employment Subcategories
Redundancy Subcategories
Remuneration Subcategories
Social Security
Social Security Contributions
Termination of Employment
Terminations Subcategories
Trade Unions
Working Hours & Pay Subcategories
Workplace Culture Subcategories
Workplace Health and Safety
Workplace Investigations
Jurisdictions
Americas Subcategories
APAC Subcategories
Cross Border
EMEA Subcategories
Global

EU: Keeping Former Employees’ Mailboxes

By - - Data Protection, Data Protection & Privacy, Employment Law

For how long, and in what format, should an employer keep a former employee’s mailbox accessible, after their departure?

The conflicting choices are:

  • Complying with data protection rules;
  • The business need to keep critical information for litigation, commercial and regulatory purposes;
  • Personal/private communications -v- business related emails.

Recent cases in Belgium and Italy have provided some indications of how employers should approach these questions.

What Employers Should Be Doing

Employers should:

  • have clear procedures for departing employees including encouraging them to remove their private messages and to transfer business emails into the employer’s shared document management system (which should be done promptly in any event);
  • revoke employee access to the account as the employment ends and ensure that any post–departure internal access is limited, appropriately authorised and logged;
  • put in place a time limited automatic reply reporting the employee has left and giving an alternative contact;   
  • plan finally to delete the account on a defined date, once litigation risks, and legal and regulatory duties have been met;
  • have procedures for responding to subject access requests;
  • have an audit system for checking that their retention policies are complied with.    

The Belgium Case

The company failed to close the email account of a former consultant which continued to receive emails from contacts who believed she remained there. The Data Protection Authority found this had contributed to a breach of the GDPR as they had continued to process the personal data of both the former employee and the external contacts. The company said it had resulted from human error, but the DPA found that there were inadequate technical and organisational controls to ensure deletion of the account. The failures resulted in a fine of EUR176,000.

The Italian Case

This case before the Italian DPA contained a number of decisions.

In response to an access request for all emails from a former employee’s work email account, the employer could not limit the disclosure to personal/private emails only. It should release all relevant emails unless it could provide specific evidence that disclosure would cause actual business harm.

In this case the employer’s policy was to retain email accounts in back-up systems for 5 years.  The DPA found this disproportionate. Emails of former employees should only be retained where there is a specific need to do so for security or litigation purposes.  Employers should be ready to justify in detail their retention choices.                

This is a high-level general update only. Legal advice should be obtained on specific circumstances.
Scroll to Top