Privacy and work relationship: How to manage the ex-employee’s e-mail accounts
By Damiana Lesce, Paola Lonigro and Valeria De Lucia
The systematic collection of the electronic communications in transit on the employees’ accounts and their storage for a long period of time is an unlawful behavior ex art. 4 Law May 20, 1970 n. 300 (Workers’ Statute). Furthermore, this behavior constitutes a criminal activity ex art. 38 of the Workers’ Statute. All this said, the subject we will take here under examination is how to manage the ex-employee’s e-mail accounts.
With the Decree of December 22, 2016, the Guarantor stated that the storage of the electronic communications for ten years is not compliant with the principles of necessity, pertinence and not excess. In fact, this extended time of retention applied indiscriminately to all exchanged e-mails does not appear to be commensurate with the ordinary needs for managing e-mail services, including security.
From the application of these principles, it follows that accounts that can be attributed to ex-employees identified or identifiable have to be removed after being deactivated. Additionally, there must be the adoption of automatic systems to inform third parties and provide them with alternative e-mail addresses.
Nonetheless – to provide an example – the following procedures have been conducted in contrast with these provisions:
- keeping e-mail boxes active up to six months from the date of the termination of the work relationship;
- automatically redirecting messages – in transit to ex-employees’ accounts – to corporate e-mail addresses assigned to other employees.
The rules summarized above are an expression of the general principle according to which the employer’s interest in obtaining the data necessary for an efficient management of his business must be balanced with the employees’ interest in confidentiality regarding correspondence. Finally, it must be said that in some cases examined by the Guarantor, the conduct of the company, which deactivated the ex-employees’ accounts but kept their e-mail data, has been considered unlawful. Indeed, the Guarantor has disposed the prohibition to collect and store these data, with the only exception of retention for trial purposes
