DPA case 2.1.-1/22/2643 – €2,500 Fine (Estonia, 2022)

The employment relationship between Retent AS (the controller) and the data subject ended in June 2022. Since then, the data subject repeatedly contacted the controller requesting the deletion of his former work email addresses. However, the controller did not block the address and continued sending emails to the data subject. The data subject submitted a complaint before the Estonian DPA, which ordered the controller to comply with the data subject's request and delete the email addresses. However, the controller did not respond to the DPA's letters. The DPA recalled that the name of a person contained in an e-mail address constitutes personal data in accordance with Article 4(1) GDPR. Personal data may only be processed if there is a valid legal basis referred to in Article 6(1) GDPR. As a general rule, an employee is given a named e-mail address to carry out tasks set out in the employment contract. Once the employment relationship ends, there is no longer a legal basis for the processing of the employee's personal data. The data subject's former work e-mail addresses were still open despite the employment contract having ended and despite a request to delete the account. The DPA noted that Article 17(1)(a) GDPR requires the controller to erase personal data without undue delay where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed. Since the controller had no legal basis for using the work email addresses, the continued disclosure of the data subject's personal data was unlawful. The DPA established a violation of Articles 6(1) and 17(1)(a) GDPR. The DPA issued a mandatory injunction against the controller in order to put an end to the infringement as soon as possible and to guarantee the data subject's right to be forgotten under Article 17 GDPR. In case the controller does not comply with the injunction within a week, the DPA will impose a €2,500 fine for the GDPR infringements.