DPA case 40/2023 – Complaint Upheld (Belgium, 2023)

The data subject was a former employee of the controller, an organisation which supported adult persons with a disability. For his job, he used a work e-mail for about 8 years, occasionally also for private e-mails. This e-mail did not contain any direct identifiers referring to the data subject. On 15 September 2020, the data subject was fired. The controller revoked the data subject's access to the e-mail by changing the password and deleting the user account. On 25 May 2021, the data subject filed an access request with the controller. He requested the personal data in the email mailbox and documents from his employment file. He also wanted to get information on what happened with the e-mail after he had been fired. On 10 June 2022, the controller informed the data subject that it would use the possibility in Article 12(3) GDPR to extend the deadline for replying with two months, due to the complexity of the request. On 24 August 2020, the controller provided its answer to the access request. However, according to the data subject, the controller's answer was not sufficient. On 22 February 2022, the data subject filed a complaint against the controller with the Belgian DPA concerning the personal data in the mailbox (and not other personal data or documents in his employment file). During the proceedings, it became clear that after 4 January 2018, the e-mail address was also used by other employees of the controller. Before this time, the data subject was the only one using this e-mail, and he had sent emails signing them with his personal name. On 18 July 2022, the controller provided several reasons why it did not comply with the access request. Among other reasons, the controller stated that the e-mail did not contain any personal data in the first place. The controller also held that the request of the data subject to search in 8 years of e-mails was excessive. The controller had also refused to provide access in order to protect the rights and freedoms o