Slovenian DPA Finds Employer's Access to Employee Emails During Absence Violated GDPR
Written by AI from the linked story. Not reviewed by an editor. How this works
An employer in Slovenia accessed and forwarded a staff member's work emails during a prolonged absence, citing business continuity — without conducting a legitimate interests assessment or considering less invasive alternatives. The Information Commissioner ruled this disproportionate and lacking a valid legal basis under GDPR, highlighting that even well-intentioned workplace actions must be grounded in documented, proportionate legal justification. This case illustrates that business continuity needs do not override employees' privacy rights when simpler measures (such as auto-replies or delegation policies) are available. Organisations that fail to formalise procedures for accessing employee accounts expose themselves to regulatory sanction and reputational harm.
Tactical Insight
Immediate actions
- Establish and document a formal policy for accessing employee accounts during absences, including required approvals and legal basis before any access occurs.
- Implement technical controls such as automatic out-of-office replies and pre-authorised email delegation as the default response to employee absence.
Long-term improvements
- Conduct and record a Legitimate Interests Assessment (LIA) or equivalent legal basis review before any monitoring or access of employee communications is permitted.
- Integrate a Data Protection Impact Assessment (DPIA) process for any HR procedures that involve access to personal data, including email management during absences.
- Train HR and management staff annually on GDPR obligations relating to employee privacy and proportionality requirements.
Detection & Governance measures
- Implement audit logging of all administrative access to employee email accounts so that unauthorised or undocumented access can be detected and reviewed.
- Assign a Data Protection Officer (DPO) or equivalent role to review and approve any non-routine access to employee personal data before it takes place.