Court case PVN-2022-14 – Court Ruling (Norway, 2022)

A company (the controller) inspected the e-mail inbox and automatically forwarded an e-mail of its former employee (the data subject) after she had objected to processing of her personal data under Article 21 GDPR. The data subject filed a complaint with the Norwegian DPA, claiming that there was no legal basis for accessing and processing her e-mails in such a form. The DPA initiated proceedings and asked the controller for explanation. After not receiving any information past the deadline, it rendered a decision. The DPA held that automatic forwarding of the contents of the data subject's e-mail box could not be based on Article 6(1)(f) GDPR nor any other valid legal basis. The controller did not comply with its duty to carry out a balancing of interests after the data subject had objected to the processing, under Article 21 GDPR. Finally, the DPA held that the controller did not comply with its duty to inform the data subject of the forwarding of her e-mails, violating Article 13 GDPR. The DPA concluded that the infringements were intentional and serious. Hence, the DPA imposed a NOK 100,000 fine on the controller. It also ordered the controller improve internal control and routines for access to employees' and former employees' e-mail boxes. The controller appealed this decision to the Norwegian Privacy Appeals Board (Privacy Board). First, the Privacy Board considered whether the DPA had been correct in imposing a fine on the controller. It recalled that Article 83(1) GDPR obliges DPAs to ensure that the imposed fines are effective, proportionate and dissuasive. In this regard, the Privacy Board held that illegal forwarding of e-mails is a violation of the basic principles of lawfulness and transparency (Article 5(1)(a) GDPR). When basic rules for the protection of employees' privacy are disregarded as in this case, the violations must be regarded as serious. Therefore, the DPA was correct to impose a fine on the controller. Second, the Privacy Board conside