18 December 2025
Confidentiality and Privacy
Email accounts after dismissal: automatic forwarding must stop and the worker must receive a response
Data Protection Authority
A manager, after receiving a disciplinary charge and subsequent dismissal, discovered that his individual corporate email account had remained active even after the termination of the employment relationship. The account, in addition to receiving new communications, was subject to automatic forwarding to other corporate email addresses. The employee therefore submitted a request seeking deactivation of the account, access to the correspondence received in the meantime, and activation of an automatic reply system indicating an alternative contact. The company failed to respond.
The Data Protection Authority held that the failure to respond to the access request was unlawful, clarifying that the employer must reply within one month even where it considers that it cannot grant the request. Nor may the employer limit access to personal emails only, since work-related correspondence on an individual account also involves data attributable to the employee.
The Authority reiterated that, for business continuity purposes, it is permissible to promptly deactivate the email account following termination, with the simultaneous activation of an automatic reply directing third parties to alternative contacts; however, maintaining the account with systematic forwarding of emails to other internal addresses is not allowed. Such conduct violates the principles of lawfulness, data minimisation and storage limitation.
The decision calls on companies to review internal policies and IT procedures to ensure that the management of corporate tools upon termination complies with the principles of proportionality and protection of the worker’s privacy.
