Skeljung hf. – Complaint Upheld (Iceland, 2020)

A data subject complained to the DPA about the treatment of his e-mail account upon termination of employment with Skeljung hf. According to the complainant, his e-mail box was closed immediately after he accepted a new job offer. About a week later, he had received information that someone was replying to e-mails that had been sent to his e-mail address at Skeljungur. Skeljungur hf. argued that the complainant was informed orally that he had the opportunity to review his personal e-mail during the notice period, as well as to delete or make a copy of a personal e-mail before leaving the company. An oral agreement had been made with the complainant that the company could forward e-mails from his mailbox to an employee in the sales department until it was ensured that all e-mails from his customers had reached the company smoothly. The complainant denied being informed orally about his rights and agreeing to such conditions. The DPA pointed out that Article 9 (4) of Rules no. 837/2006 lays down the procedure to be followed by the employer in case of the termination of employment. The employee shall be given the opportunity to delete or make a copy of the e-mail that is not related to the employer's activities. He shall also be instructed to activate an automatic reply from his mailbox that he has resigned. No later than two weeks later, the mailbox should be closed. It is also stated that the employer is not permitted to forward to another employee the mail that arrives in the former employee's mailbox after leaving unless otherwise agreed. As it turned out during the investigation, none of these provisions were fulfilled. In the opinion of the DPA, the company has not demonstrated that the aim of securing its business interests could not have been achieved by other and less severe measures, such as an automatic response that the complainant had resigned and a reference to another e-mail address. The DPA concluded that the treatment of Skeljungs hf. of the e-mail