Company email: worker entitled to full access, employer filters unlawful

Privacy and Data Protection
Company Email: Worker Entitled to Full Access — Employer Filters and Redactions Unlawful
Garante Privacy

A worker, following the termination of his employment, requested that the company grant him access to his company email account and provide a complete copy of its contents. The company allowed only partial access, limited to messages deemed “personal”, excluding those relating to work activity and redacting content to protect third-party data and company information.
Following a complaint, the Authority clarified that communications exchanged via company email fall within the scope of the worker’s personal data. It follows that the right of access cannot be unilaterally restricted by the employer to “personal” content only, nor can it be made conditional on prior selection or filtering by the company.
The generalised anonymisation of emails was also found unlawful, in the absence of concrete and demonstrated prejudice to the rights of third parties or company trade secrets. A mere protective interest is not sufficient to curtail the right of access.
The Authority further criticised the systematic retention of emails for extended periods — up to five years — through backup systems, particularly in the absence of adequate information to workers. Email systems cannot substitute structured document management tools compliant with the principles of data minimisation and transparency.
The ruling thus reaffirms strict limits both on the management of company email accounts and on the handling of workers’ access requests.