CyberBook AS – €17,400 Fine (Norway, 2021)

A company enabled automatic forwarding of a former employee's emails, to "uphold regular business operations", and argued that it was the complainant fault this was deemed necessary. Despite several objections from the complainant, the company continued to monitor the email account over several months. The unlawful monitoring did not stop until the complainant contacted the DPA. Did the company have a legal basis for monitoring the former employee's email account? The DPA held that the company did not have a legal basis for monitoring the former employee's email account, as per Article 6(1)(f) GDPR. The DPA further held that the company failed to: * provide the data subjects with required information, as per Article 13 * terminate the former employee's email account, as per Article 6(1)(f) * erase the content of the former employee's email account, as per Article 17(1)(e) * assess the former employee's objections, as per Article 21 For this, the company was fined NOK 200 000 (€19,600) and ordered to establish written internal controls and routines for access to current and former employees' email accounts and other electronic content, in line with Article 24.