Redacted – €8,700 Fine (Norway, 2022)

An employee (the data subject) had quit their job and was supposed to assist the employer (the controller) during the notice period. However, due to disagreements, the controller blocked the data subject's access to email and business systems and enabled automatic forwarding of emails to the general manager of the company. The data subject objected to this processing, but the controller upheld it for several weeks and only stopped it when the general manager realized it could be problematic. The Norwegian DPA (Datatilsynet) launched an investigation after receiving both a notification from the controller, as well as a complaint from the data subject. The controller explained to the DPA that they had enabled automatic forwarding of the emails because the data subject had refused to enable an out of office reply. They further argued that this was necessary to uphold customer relations and daily operations, and because they had discovered that the data subject had violated work duties a few months earlier. The controller also claimed that the data subject had consented to the processing, however this was denied by the data subject and the controller was unable to document their assertion. The DPA held that the controller lacked a legal basis as per Article 6(1)(f) GDPR for accessing and monitoring the data subject's email inbox, that they had failed to provide required information to the data subject as per Article 13 GDPR and for failure to assess the data subject's objection as per Article 21 GDPR. For this, the DPA fined the controller €9,775 and required them to improve internals controls for employee emails as per Article 24 GDPR. = First, the DPA assessed if the controller had a legal basis as per a national (Norwegian) [https://lovdata.no/dokument/SF/forskrift/2018-07-02-1108 regulation concerning employers' access to employees' inboxes and other electronically stored material], which allows such processing if one of two possible conditions are fulfilled. First, the DPA found that "upholding customer relations and daily operations" and "suspicion of violations of work duties", as argued by the controller, are legitimate purposes as per the regulation §2(1). However, this only allows for single accesses for a specified purpose. Automatic enabling of forwarding is considered as continuous surveillance and the processing could therefore not be based on this condition. Continuous surveillance is regulated by §2(2), but solely for purposes of administrating the computer network or to uncover or solve security breaches in the network. Consequently, the processing could not either be based on this condition. Further, the DPA found that the conditions in Article 6(1) GDPR was not fulfilled. The only available legal ground for this type of processing is Article 6(1)(f) GDPR, where three conditions must be fulfilled: the processing must be necessary for legitimate interests, and these interests must outweigh the rights and freedoms of the data subject. The DPA had already concluded that the purposes were legitimate. However, they held that the purposes could have been achieved by less privacy-invasive measures, for example by deactivating the email inbox and/or enable automatic forwarding themselves. Consequently, the DPA held that the controller lacked a valid legal basis as per Article 6(1)(f) GDPR. = The DPA found that the controller was unable to demonstrate that they had considered the data subject's objection, or that they had conducted a specific legitimate interest assessment in line with Article 21 GDPR. = The DPA held that it is highly likely that the controller had violated the right to information as per Article 13 GDPR.