DPA case CDP/COMP/577/2023 (former employer) – Dismissed (Malta, date unknown)

In CDP/COMP/577/2023, Malta’s Information and Data Protection Commissioner dismissed an anonymised former employee’s allegations against his former employer. The employee alleged unlawful access to his work mailbox after employment ended and a refusal to let him delete personal information. The Commissioner recognised that a work email address containing the employee’s name is personal data. The reasoning explains that a departing employee should be allowed to copy and delete personal emails, followed by proportionate archiving and deletion. On the facts, however, the complainant confirmed that he had regained access and deleted the contents. He supplied no concrete evidence that third parties had illegally accessed the account or extracted personal information. The original distinguishes technical access by the hosting webmaster to restore the employee’s access from the alleged spying. The Commissioner found no grounds to unequivocally determine a GDPR infringement and dismissed the allegations in their entirety. No fine or corrective order was imposed in the operative conclusion. The published PDF contains four pages labelled as pages 1–4 of five and does not establish the decision date. Complaint dates, investigation correspondence, the case-number year and PDF metadata are not treated as the decision date; appeal status is not established.