{"id":25374,"date":"2026-04-24T08:34:41","date_gmt":"2026-04-24T08:34:41","guid":{"rendered":"https:\/\/toffolettodeluca.it\/?p=25374"},"modified":"2026-04-24T08:34:42","modified_gmt":"2026-04-24T08:34:42","slug":"former-employees-access-company-emails-data-protection","status":"publish","type":"post","link":"https:\/\/toffolettodeluca.it\/en\/former-employees-access-company-emails-data-protection\/","title":{"rendered":"Former employees and access to company email: Data Protection Authority guidelines"},"content":{"rendered":"\n

With its newsletter of 15 April, the Data Protection Authority<\/strong> (DPA) issued Measure 165 of 12 March 2026<\/strong> sanctioning a company for non-compliant management of access by a former<\/em> employee to their company email<\/strong> account, as well as for their methods for storing <\/strong>and processing emails and internet logs<\/strong>.<\/p>\n\n\n\n

Access to company email<\/h3>\n\n\n\n

The measure originated from a complaint by a former<\/em> employee who, after leaving the company, had requested access to the data<\/strong> in their company email<\/strong> account. The company had actually provided only emails <\/strong>deemed \u201cpersonal<\/strong>\u201d, excluding any of a work-related nature, on the assumption\u2014considered incorrect by the Data Protection Authority (DPA)\u2014 that this content was exclusively company property. The company had also selected<\/strong> and redacted some of the content<\/strong>.<\/p>\n\n\n\n

In justification of its decision, the DPA clarifies that the right of access applies to all personal data <\/strong>regarding the interested party, even when included in business communications. This is because the distinction<\/strong> between private <\/strong>and professional sphere<\/strong> is not clear: even in the workplace, relationships develop that fall within the notion of “private life” and “correspondence”, and as such are protected. Consequently, the employer may not filter the content of an email account in advance or restrict access solely to personal communications.<\/p>\n\n\n\n

In this context, the DPA reiterates that the right of access can be limited only in those cases strictly<\/strong> provided for by the GDPR, namely in the event of manifestly unfounded or excessive requests or when necessary to protect the rights and freedoms of others. In the case of the latter, the Authority recalls that protectable rights also include industrial and trade secrets and intellectual property. However, even reference to these is not in itself sufficient to justify a limitation of the right of access since the data controller must provide tangible proof<\/strong> that fulfilment of the request would result in actual harm.<\/p>\n\n\n\n

In the case in question, this proof was not provided. On the one hand, the data relating to third parties were included in communications already known to the interested party, making redaction unnecessary; on the other, the company did not produce elements that proved access to the correspondence could lead to an actual risk to confidentiality related to company information and\/or third parties. In line with these principles, Measure 121 of 26 February 2026<\/strong> also reiterates that the right of access<\/strong> is fully exercisable also for documents or information already in the possession<\/strong> of the interested party. In the case under examination, in fact, the Authority recognised the legitimacy of the request made by a former<\/em> employee to obtain a copy of their employment contract documents, clarifying that the prior availability of data does not extinguish or limit the right of access.<\/p>\n\n\n\n

Storage of email and internet logs<\/h3>\n\n\n\n

Regarding storage<\/strong> of corporate email<\/strong>, the DPA deems the following to be non-compliant:<\/p>\n\n\n\n