Skeljung hf. – Complaint Upheld (Iceland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Icelandic company, Skeljung hf., mishandled an ex-employee's email account after he left the company. The privacy authority found that the company didn't follow proper procedures for managing the email, which could have protected both the ex-employee's privacy and the company's interests. This case highlights the importance of following clear guidelines when handling former employees' data.
What happened
Skeljung hf. forwarded emails from a former employee's account without his consent after he left the company.
Who was affected
The affected person was a former employee of Skeljung hf. whose email account was mishandled after he left the company.
What the authority found
The privacy authority concluded that Skeljung hf. did not follow the required procedures for handling a former employee's email, violating data protection rules.
Why this matters
This decision emphasizes the need for companies to have clear policies for managing ex-employees' data to avoid privacy breaches. It serves as a reminder to businesses to ensure compliance with data protection rules when handling personal information.
GDPR Articles Cited
National Law Articles
A data subject complained to the DPA about the treatment of his e-mail account upon termination of employment with Skeljung hf. According to the complainant, his e-mail box was closed immediately after he accepted a new job offer. About a week later, he had received information that someone was replying to e-mails that had been sent to his e-mail address at Skeljungur. Skeljungur hf. argued that the complainant was informed orally that he had the opportunity to review his personal e-mail during the notice period, as well as to delete or make a copy of a personal e-mail before leaving the company. An oral agreement had been made with the complainant that the company could forward e-mails from his mailbox to an employee in the sales department until it was ensured that all e-mails from his customers had reached the company smoothly. The complainant denied being informed orally about his rights and agreeing to such conditions. The DPA pointed out that Article 9 (4) of Rules no. 837/2006 lays down the procedure to be followed by the employer in case of the termination of employment. The employee shall be given the opportunity to delete or make a copy of the e-mail that is not related to the employer's activities. He shall also be instructed to activate an automatic reply from his mailbox that he has resigned. No later than two weeks later, the mailbox should be closed. It is also stated that the employer is not permitted to forward to another employee the mail that arrives in the former employee's mailbox after leaving unless otherwise agreed. As it turned out during the investigation, none of these provisions were fulfilled. In the opinion of the DPA, the company has not demonstrated that the aim of securing its business interests could not have been achieved by other and less severe measures, such as an automatic response that the complainant had resigned and a reference to another e-mail address. The DPA concluded that the treatment of Skeljungs hf. of the e-mail
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Skeljung hf. in IS
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Skeljung hf. - Iceland (2020). Retrieved from cookiefines.eu
Last updated: