DPA case 135/2023 – Complaint Upheld (Belgium, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company continued to use a former employee's email account after their job ended, sending emails without the person's knowledge. This is important because it shows that companies must stop using ex-employees' accounts and respect their privacy. Businesses should ensure they deactivate accounts promptly after employment ends.
What happened
The company sent emails from a former employee's account without their consent after their employment ended.
Who was affected
The former employee whose email account was misused by the company.
What the authority found
The Belgian DPA ruled that the company violated GDPR by continuing to access and use the former employee's email account after their employment ended.
Why this matters
This case emphasizes the need for companies to manage employee accounts responsibly and protect former employees' privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The complaint concerned the unlawful use of the data subject's former employee e-mail account. The data subject was an employee of the controller until 30 April 2023. On 9 May 2023, an email was sent without the data subject's knowledge from their former employee e-mail address, informing the controller’s clientele that the data subject was no longer employed with them and of the new contact point. Following the email of 9 May 2023, the data subject’s work e-mail was still active and its contents were being read. The data subject discovered this and on 8 July 2023, requested the controller to delete their former employee e-mail. The data subject received no response to their request. On 17 July 2023, the data subject filed a complaint with the Belgian DPA. The Belgian DPA found a breach of Articles 5(1)(b) and 5(1)(c) GDPR, Article 6(1) GDPR and Article 13(1)(c) GDPR. Firstly, the Belgian DPA found that there had been a violation of the principles of data minimisation (Article 5(1)(c) GDPR) and purpose limitation (Article 5(1)(b) GDPR) as the data subject’s e-mail account remained active and in-use following the termination of the employment relationship on 30 April 2023 and following the e-mail of 9 May 2023. The controller, following these two events, continued to access, use and send e-mails to external persons from the data subject’s e-mail address. Secondly, the Belgian DPA found a breach of Article 6(1) GDPR and Article 13(1)(c) GDPR. The DPA found that the controller could not seek to rely on Article 6(1)(b) GDPR as a legal basis, because the processing continued following the termination of the employment contract. Moreover, neither could the controller rely on Article 6(1)(f) GDPR as a legal basis. Keeping the mailbox active after the termination would only have been legitimate for the purposes of Article 6(1)(f) GDPR, if this was done during the transition period following the end of the employment contract “…so far as this is limited to the automatic
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 135/2023 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 135/2023 - Belgium (2023). Retrieved from cookiefines.eu
Last updated: