- Enforcing jurisdiction
- Belgium · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 71/2024 – Complaint Upheld (Belgium, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A former employee of a company disputed whether she could access her work email after being dismissed. The authority ruled that the company must delete her email account within a month unless they had a different agreement with her.
What happened
The company cut off access to a former employee's work email after her dismissal.
Who was affected
The former employee who was denied access to her professional email account.
What the authority found
The authority stated that the company must delete the former employee's email account within a month unless otherwise agreed.
Why this matters
This ruling highlights the need for companies to have clear policies on data retention and access after an employee leaves. It reminds businesses to respect former employees' privacy rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The senior director of marketing and managing director of a company ('data subject') was dismissed from her workplace in August 2022, after which she had to serve a six-week notice period. During these six weeks, a dispute arose regarding whether she was still allowed to access her professional mailbox. The access to her mailbox was cut off on 12 September 2022. An access to said mailbox was allegedly given to her superior. However, he was requested not to access the mailbox. On 15 September 2022, the data subject made an access request and asked that the controller confirm that no one had accessed her mailbox on the basis of IT logs. On 25 January 2023, the controller responded by providing a summary of the logs relating to the disputed mailbox. These logs showed that there was no access to this mailbox. However, the data subject claimed that this document was inaccurate or incomplete. She also noted that her professional email account still existed in January 2023, well after her departure from her workplace. The data subject filed a complaint with the Belgian DPA ('GBA'). Firstly, the DPA held that in principle further processing of a mailbox is lawful, as long as some conditions are respected. The DPA said the mailbox can remain active for a certain period of time after the dismissal of the data subject as long as it is limited to the automatic sending of standard communications regarding the departure of the data subject, in order to ensure the proper functioning of the company. However, the GBA added that the other provisions of the GDPR must also be respected. The GBA then established that the controller has one month after which it must delete the data subject’s email address and mailbox, unless other agreements have been made between the controller and former employee in that regard. A longer period may be granted depending on the context and degree of responsibility of the data subject but this extension must be done with the data subject’s consent. I
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 71/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 71/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: