MONITORING OF EMPLOYEES’ WORK E-MAIL ACCOUNTS: UNLAWFUL PROCESSING ACCORDING TO THE DATA PROTECTION AUTHORITY
With provision no. 476 of 18 June 2026, the Italian Data Protection Authority (i.e., Garante della Privacy) ruled on breaches of data protection legislation committed by an employer in relation to the management of employees’ work e-mail accounts, the retention of their data and the unlawful remote monitoring of employees.
According to the Authority:
- a personalized work e-mail address (i.e., one assigned to a specific employee), as well as the content of the emails in that account, constitute the employee’s personal data, and, consequently, the guarantee of confidentiality of correspondence must be applied to work e-mails;
- the collection and retention of data and e-mails do not constitute a work tool, as they are not essential for the performance of work, thus such retention should be subject to the prior authorization from the trade unions or the relevant administrative authority, as provided for in Article 4(1) of the Workers’ Statute.
This reasoning led the Authority to impose an administrative fine of €460,000 against a company for unlawfully processing the personal data of employees because it had accessed the work e-mail accounts of two former employees in order to verify the validity of allegations of unlawful conduct on their part dating back up to two years before such suspicions arose.
This operation had been made possible by the employer’s systematic collection and retention of e-mail data via backups throughout the duration of the employment relationship and for up to 5 years after its termination, as well as the retention of the relevant logs for a period of 6 months: the Authority deemed these timeframes to be excessive and these practices to be entirely lacking in the necessary safeguards.
