DPA case 97/2024 – Complaint Upheld (Belgium, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Belgian company kept an employee's professional email active after he was dismissed, ignoring his request to close it. The data protection authority ruled that the company should have deactivated the email immediately after the employee left, which is important for protecting personal data. This case serves as a reminder for businesses to respect employees' privacy after they leave.
What happened
The company failed to deactivate a former employee's professional email account after his dismissal.
Who was affected
The former employee whose email account was kept active without his consent was affected.
What the authority found
The authority found that the company violated GDPR rules by not closing the email account after the employee's termination.
Why this matters
This case highlights the need for companies to promptly deactivate access to personal data after an employee leaves. Businesses should establish clear policies for handling former employees' data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was employed by the controller with the role of managing 30 residential buildings. In October 2020, the controller dismissed the data subject without notice, believing he made several mistakes during his job. After the termination of the employment contract, the controller kept the professional email address of the data subject active. It argued that it needed that email inbox in order to ensure the tasks that were taken care by the data subject could be smoothly transferred to someone else. Therefore, it argued that it has a legitimate interest under Article 6(1)(f) GDPR to keep the email inbox active. On 11 November 2020, the data subject asked the controller to stop using his email inbox and filed an erasure request pursuant to Article 17 GDPR. The controller did not reply to this request. On 3 December 2020, the data subject filed a complaint with the DPA. First of all, the DPA pointed out that the email address of the data subject is personal data according to Article 4(1) GDPR, since it is a piece of information relating to an identified or identifiable natural person. Secondly, the DPA noted that this address had been created for professional purposes, namely to allow the data subject to send and receive emails relating to his professional activity. According to the DPA, it follows from the principle of purpose limitation set by Article 5(1)(b) GDPR that the controller is obliged to close the inbox after a data subject terminates their job. The DPA added that, before doing this, the controller must activate an automatic reply, informing that the data subject is not working for the controller anymore and indicating another email address which the clients can use. However, the DPA also noted that, depending on the role of the data subject (for example, if the data subject is the CEO or is the only person that is in charge of doing something in the controller’s organization), a delay up to 3 months can be admissible. In the case at hand, the D
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 97/2024 in BE
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 97/2024 - Belgium (2024). Retrieved from cookiefines.eu
Last updated: