DATA PROTECTION | Italian DPA fines a company for unlawful access to employee’s mailbox

On 17 July 2024, with Order No. 472 the Italian Data Protection Authority (DPA) issued a fine of 80,000 euro to a company for the unlawful access and processing of a former employee’s mailbox data. After the employee’s dismissal, the company engaged an external tech firm to examine the mailbox, suspecting potential misappropriation of business secrets. Using MailStore software, initially intended for backup as part of the company’s business continuity and disaster recovery plan, the company accessed and downloaded emails from the former employee’s account. Although the company had a policy in place informing employees of possible access to their mailbox, the DPA found that the policy allowing for a three-year retention of emails after employment termination exceeded legitimate business needs and breached data protection standards. The DPA ruled that the systematic storage of emails and access logs was disproportionate and unnecessary for the declared security purposes, constituting an unlawful form of employee surveillance. The DPA also emphasised that email access for litigation purposes should be limited to active legal proceedings rather than speculative inquiries. In addition to the fine, the DPA ordered the company to cease processing data through the email backup software.

Newsletter n. 101 – November 2024