Datatilsynet – Court Ruling (Norway, 2024)

The controller, an employer, suspected that an employee had committed embezzlement and carried out an inspection of the employee’s mailbox. After discovering e-mail exchanges between the employee and another employee (the data subject), the controller also suspected that the data subject contributed to a possible embezzlement and accessed their mailbox as well. Access to the data subject’s mailbox was carried out by the controller with the assistance of a third party and a data processor. The inspection of the e-mails showed the data subject had breached their duty of loyalty in their employment by sharing insider information and other confidential information. The data subject was then dismissed. On 12 July 2020, the data subject lodged a complaint at the Norwegian DPA (“Datatilsynet”). The data subject argued that the controller had no legal basis for conducting an inspection and disclosing their personal data. The DPA found that the controller failed to comply with the accountability principle under Article 5(2) GDPR as the controller did not submit documentation of the legal basis for conducting the inspection of the data subject’s mailbox. The DPA held that the controller had a legitimate interest to inspect the data subject’s mailbox under Article 6(1) GDPR and Section 2 of the Norwegian E-mail Regulations (“[https://lovdata.no/dokument/LTI/forskrift/2018-07-02-1108 e-postforskriften]”). Under the E-mail Regulations, an employer has the right to access an employee’s mailbox in the event of "reasonable suspicion that the employee's use of a mailbox or other electronic equipment results in a serious breach of the obligations arising from the employment relationship or may provide grounds for termination or dismissal". However, the DPA found that the controller did not process the data subject’s personal data with sufficient transparency under Article 5(1)(a) GDPR and Article 14 GDPR, as the data subject was not informed about the processing. The DPA stated that