DATA PROTECTION: THE DATA PROTECTION AUTHORITY RETURNS TO THE PRESERVATION OF EMAILS AND COMPANY LOGS
The Data Protection Authority has established that an employer who fails to inform employees and collaborators about the creation and storage of backup copies of emails on company accounts violates data protection regulations. This informational obligation also includes the need to clarify any investigations the company might conduct on the data stored through these backups. This omission constitutes a violation of the transparency principle enshrined in the General Data Protection Regulation (GDPR), which requires data controllers to clearly communicate the purposes and methods of personal data processing.
The Authority also deemed the practice of retaining data related to emails and access logs to company accounts for three years after the end of the employment relationship as disproportionate. Such a duration exceeds the necessary limits to achieve the declared purposes, namely the security of the information network and the operational continuity of the company. In this way, the principle of storage limitation provided by the GDPR is violated, which requires maintaining personal data only for the time strictly necessary to achieve the purposes for which they were collected.
Additionally, the Authority identified a potential violation of Article 4 of the Workers' Statute (Law 300/1970), which regulates the use of tools that may involve monitoring work activities. This regulation stipulates that the installation and use of devices that allow indirect monitoring of employees' activities are subject to a union agreement or, in its absence, authorization from the Labor Inspectorate. The long-term retention of data such as emails and access logs, without the necessary authorizations, can constitute a covert monitoring system, aggravating the regulatory violation.
In the specific case examined, the Authority found that the company's conduct constituted unlawful processing of personal data and fined the company 80,000 euros. This measure underscores the importance for companies to strictly comply with data protection regulations and to operate with transparency and proportionality in the processing of workers' personal information, both during and after the employment relationship.
