The Employee’s “Personal Data” Boundaries

The case of the former CEO of the European Union Programmes Agency, Doreen Camilleri, set a precedent that confirmed that a corporate email address with an individual’s name should be considered as “personal data”.

After her job was terminated, the agency requested a password change for her corporate email address, however Ms Camilleri was not informed of this and she was blocked out of her account. A few days later, Ms Camilleri found out that her e-mail address was still in use, but she could not access it herself. The concern that the emails could still be sent on her behalf was a reason to file a complaint.

In reaching this decision, the Court of Appeal held that the legal basis for processing personal data must be carefully determined (by data controllers) and it must adhere to the law and circumstances.

The password communicated to the user must be changed immediately upon receipt. In default of such action, the user assumes liability for all activity logged with the unchanged password once this notice is communicated, without prejudice to any other liability incurred by the user for activity logged on the account from the time the password is changed.

In the employment context, any computer hardware and access to any electronic communication and networking service, including but not limited to electronic mail, internet, internal servers and archive folders are considered to be the property of the employer who regulates their use for the ultimate legitimate interest of the business and administrative activity.

Even though the email account of the employee is his property, the IT manager might have access to it for a short period of time. This does not necessarily mean that every time the inbox is checked, processing of personal data of said employee had taken place.

If one must use some logic, the employee is to be cordially asked to give a handover, which in turn would initiate the process of archiving of emails that are on the former employee`s account.

While business continuity is a crucial aspect when dealing with handovers, employees’ rights should not be breached in the process.