DPA case NAIH/2020/34/3 – €581 Fine (Hungary, 2020)

The complainant was employed as a civil servant, but his employment was terminated in February 2019. The complainant knew of his termination four months in advance (October 2018), and so filed an employment law action in early November 2018. In the course of the employment law proceedings, the complainant sought access to the entire 2018 archive of his email account on a CD, which included partly private letters, correspondence concerning with publishers from certain publications regarding to the complainant's research and letters regarding other applications and the complainants' doctoral training. The respondents rejected the complainant's reasons for the requests, stating that no interest would justify the complainant's access to the mail account again as a former civil servant. Did the complainant have a right of access under Article 15 GDPR? By denying the complainant access, did the respondent infringe Articles 12(1) or 12(2) GDPR? The NAIH that the complainant's right of access could only be partly upheld. In particular, given the volume of emails requested and the complainant's failure to specify which emails they required, the NAIH held that pursuant to Recital 63 GDPR, the complainant should have specified to which emails the request related and that the respondent could legitimately refuse the complainant access to the entire archive of emails from 2018. However, the NAIH also held that the application of Recital 63 did not deny the complainant access to all of his letters and correspondence. The NAIH noted that the respondents could have asked the complainant to clarify which emails he specifically required, or they could have sorted the letters into private and business categories. On this basis, the NAIH decided that the respondents had failed to provide the complainant with adequate and transparent information on accessing his private letters pursuant to Article 12(1). Subsequently, the NAIH held that the respondents had infringed Article 12(2