Review and use of private e-mails led to severe criticism
The Danish Data Protection Agency has ruled that it was illegal for a company to access and download a former employee’s private e-mails. The employee’s interests overrode the company’s legitimate interests.
A dispute with a former employee resulted in a lawsuit and a police report. The issue was whether the employee had engaged in competitive activities during their employment.
During the case, it became clear that the company had secured evidence from the employee’s private e-mail account. The company had gained access to the private e-mails as the employee’s personal e-mail account was still open on the laptop returned to the company. The company had searched for clients and downloaded relevant e-mails from the private account.
The Danish Data Protection Agency concluded that the company’s legitimate interest in securing evidence for the lawsuit and the police report did not override the employee’s right to privacy. The right to keep private e-mails private outweighed the company’s interests. It emphasised that it was clear to the company that the e-mails came from a private e-mail account. It was also evident that searching through the account could provide information that was none of the company’s business.
IUNO’s opinion
The case serves as a good reminder of the general rule that companies cannot access private e-mails. Doing so may breach the criminal code and the data protection rules.
IUNO recommends that companies be aware that special requirements apply when relying on the "balancing test” for their processing activities. The reason is that legitimate business interests may be overridden by the employee’s interests, depending on the circumstances.
[The Data Protection Agency’s decision of 25 October 2024 in case no. 2024-31-0529]
A dispute with a former employee resulted in a lawsuit and a police report. The issue was whether the employee had engaged in competitive activities during their employment.
During the case, it became clear that the company had secured evidence from the employee’s private e-mail account. The company had gained access to the private e-mails as the employee’s personal e-mail account was still open on the laptop returned to the company. The company had searched for clients and downloaded relevant e-mails from the private account.
The Danish Data Protection Agency concluded that the company’s legitimate interest in securing evidence for the lawsuit and the police report did not override the employee’s right to privacy. The right to keep private e-mails private outweighed the company’s interests. It emphasised that it was clear to the company that the e-mails came from a private e-mail account. It was also evident that searching through the account could provide information that was none of the company’s business.
IUNO’s opinion
The case serves as a good reminder of the general rule that companies cannot access private e-mails. Doing so may breach the criminal code and the data protection rules.
IUNO recommends that companies be aware that special requirements apply when relying on the "balancing test” for their processing activities. The reason is that legitimate business interests may be overridden by the employee’s interests, depending on the circumstances.
[The Data Protection Agency’s decision of 25 October 2024 in case no. 2024-31-0529]
Similar
Expensive right of access requests
Seven commandments when closing the business e-mail account
Unfair design practices resulted in a 345 million euro fine
Accessible personnel files resulted in a data breach
Deadline to establish whistleblower schemes for medium-sized companies approaching
New guidance from the Danish Data Protection Agency on direct marketing