Elit Elektro AS – €26,100 Fine (Norway, 2022)

A former employee lodged a complaint with the Norwegian DPA (Datatilsynet) about the unlawful forwarding of and access to their email inbox after they had left a company. The data subject had objected to the processing, but the controller had declined to sufficiently assess their objection, or to stop the processing. The DPA's investigation revealed that the controller had not actually enabled automatic forwarding of the data subject's particular email address. They had also deleted the data subject's inbox shortly after they had left the company. Thus, the controller argued that they had not accessed the data subject's emails in any way. However, in 2018 the company had enabled functionality that would retrieve and forward emails with certain keywords sent to non-registered email addresses belonging to their domain, to one collective inbox. The reason for this was evidently that a customer had once sent an email to an incorrect address and this functionality could mitigate the risk of not receiving customer emails. This also meant that even though the controller had deleted the data subject's inbox, emails sent to their address could still be routed to the company's collective inbox. This had happened once, according to the controller. The DPA noted that for automatic forwarding of emails to take place, it is not a condition that the email address must exist, as long as emails are actually being forwarded, which had happened in this case. They also referred to practice from the Norwegian Privacy Appeals Board (Personvernnemnda) concluding that automatic forwarding of employee emails is equivalent to continuously monitoring their inbox. As per the Norwegian [https://lovdata.no/forskrift/2018-07-02-1108/ regulation concerning employers' right of access to employees' e-mail inboxes and other electronically stored material], this is only allowed under certain circumstances such as finding and solving data breaches. Thus, the DPA held that the company had enabled auto