Excempt from public disclosure – €21,750 Fine (Norway, 2021)

The DPA reviewed two events where a company had obtained access to an employee's emails. In the first case, the company had accessed her inbox due to an acute situation where they needed to obtain crucial (business) information while the employee was on vacation (and couldn't be reached). In the second case, however, the general manager had introduced a new policy, requiring the employee to continuously forward all her emails to a shared, common inbox at the company. After a month, she disabled this, however was instructed to enable it again. Did the company breach Article 6(1)(f) GDPR for lack of a legal basis? In the first case, the DPA agreed that the company had a legal basis, due to an acute nature of the situation and the need for crucial (business) information. In the second case, however, the DPA held that the company had no legal basis for such processing, as it's highly invasive and not justified. The legal basis the company referred to, a national regulation concerning employers' access to employees' inboxes and other electronical material, was not applicable in this instance. The DPA held that the company had no legal basis as per Article 6(1)(f) GDPR and that they had failed to inform the employee sufficiently as per Article 13 GDPR. Consequently, they were fined NOK 250 000 (€24,772), and also have to improve their internal controls in line with Article 24 GDPR.