IP (Slovenia) - 06111-65/2023/12
Slovenian DPA finds employer violated GDPR by accessing and forwarding employee's emails during absence.
The Information Commissioner (IP) in Slovenia ruled that an employer violated GDPR by accessing and forwarding emails from an employee's work account during their prolonged absence. The employer claimed business continuity, but the DPA found the measure disproportionate and lacking a valid legal basis, especially since less intrusive options like automatic replies were available and no evidence of a legitimate interests assessment was provided.
AI summary of the linked source. Not reviewed by an editor. How this works
Run IP (Slovenia)?
Get an email when a new story names IP (Slovenia), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn employer in Slovenia accessed and forwarded a staff member's work emails during a prolonged absence, citing business continuity — without conducting a legitimate interests assessment or considering less invasive alternatives. The Information Commissioner ruled this disproportionate and lacking a valid legal basis under GDPR, highlighting that even well-intentioned workplace actions must be grounded in documented, proportionate legal justification. This case illustrates that business continuity needs do not override employees' privacy rights when simpler measures (such as auto-replies or delegation policies) are available. Organisations that fail to formalise procedures for accessing employee accounts expose themselves to regulatory sanction and reputational harm.