Attention to privacy in the employment context is growing, as is the Italian Data Protection Authority’s (Garante) involvement in clarifying the related regulatory issues.

One recurring issue brought before the Garante in the past few years involves employees’ email privacy before and after termination of the employment relationship. The Garante issued an initial overall set of instructions on March 1, 2007—Guidelines Applying to the Use of Emails and the Internet in the Employment Context—to help employers ensure that internet and email use in the workplace complies with data protection laws. Since then, the Garante has issued several decisions in this respect.

Below, we have prepared a summary of these rules and guidance for the proper conduct / best practices for employers when handling employee emails in the workplace, both during employment and after termination of the employment relationship.

Employees’ email privacy during the employment relationship

In the context of employment, an access to employee emails by the employer must be carefully considered as it can potentially be questioned by the Garante. Personal email should be inaccessible, since access by the employer could qualify as a violation of an individual’s constitutional right to secrecy of correspondence. But what about non-personal emails that only relate to the job carried out at the workplace?

The issue is quite complex but, as indicated by the Garante, having a specific (and written) internal policy on how employee email will be handled, with an explanation of how employer controls will be carried out, is certainly a good starting point. Without such policy, employees may have an expectation of confidentiality, and employers would not be bound by clear rules to prevent unlawful interference with the employees’ right to privacy. Once the internal policy has been prepared, the employer shall ensure that employees are duly informed about it.

In terms of specific instructions, the Garante pointed out that employers should:

1. provide for email accounts to be shared by a number of employees, thus making the non-private nature of the correspondence implicit;
2. make a personal email account available to employees for their private purposes;
3. allow for the automatic sending of “out-of-office” messages when employees inform the employer that they will not be at work;
4. allow employees to designate a colleague who is able to access their work email when the employee is unexpectedly absent, or absent for a prolonged period;
5. include an automatic disclaimer in the email body, clearly stating that the communication is not personal and, where appropriate, reply messages may be accessed by third parties in the sender’s organization.

Email data retention is another issue of concern to the Garante. As a general rule, employers need to ensure that employees have been informed of the retention period for emails containing personal data. Such retention should be limited to what is necessary in relation to the purposes for which personal data is processed.

According to the Garante, the retention period for emails can only be extended in the following, very limited, circumstances:

1. if specific technical and/or security reasons require the extension of the retention period to ensure adequate protection;
2. the data contained in the emails is necessary to bring or defend a judicial claim;
3. there are specific requests from judicial authorities demanding that the retention period be extended.

The Garante also recently addressed the retention of metadata (i.e. organized reference data that aids in the sorting and identification of attributes of the data it describes, e.g. the date and time of sending/receiving, name of the sender/recipient, subject line, etc.). In its Decision no. 409 of December 1, 2022, the Garante pointed out that since email metadata may include personal data, it must therefore only be processed for as long as necessary to achieve the specific purpose. In addition, employers must use caution with any blanket retention of such data, as the data could allow the employer to obtain information about the private life of the employee that is irrelevant in the context of the employment relationship.

Employees’ email privacy when the employment relationship is over

One primary concern organizations have when their employees leave is how to ensure business continuity for the activities that were carried out by the now-departed employee without violating the rules on retention of personal data.

In this respect, the Garante (in its decision no. 216 of December 4, 2019) provides specific instructions with regard to accessing the email accounts of former employees. According to such instructions, employers must first deactivate and then delete the email accounts that were once used by their employees. In addition, they must implement an automatic alert—which informs senders that the address they have attempted to contact no longer exists and provides an alternative address—and adopt adequate measures to make impossible the reading of incoming emails while also ensuring that the deactivation and removal of the account takes place within a reasonable time period.

The question of precisely how long an email address may be kept active remains open and a case-by-case analysis remains recommended. The Garante has not set out an acceptable retention period, but in many cases indicated what is not allowed and employers can use the latest Garante decisions as a bellwether. For instance, with Decision no. 547 of December 22, 2016, the Garante clarified that keeping an email account active for six months after the date of termination of the employment relationship is not in compliance with general privacy principles.

Why do companies need to be concerned about protecting employees' email privacy?

Employers are obliged to always carefully address privacy in the workplace—and email is no exception. In addition to remaining compliant with data protection laws, due handling of employee email contributes to ensuring a better workplace, a higher level of protection for employee confidentiality and enhanced transparency in the employer-employee relationship. Thus, privacy can indeed constitute an added value for businesses and is not merely a legal fulfilment / economic burden.

Finally, employers should be aware of the cost of violating privacy laws. In this regard, under the GDPR, the Garante can impose administrative fines of up to €20 million, or 4 percent of the previous year’s worldwide group turnover, whichever is higher (in very limited and specific circumstances, criminal charges may also be applied). Furthermore, the Garante may order the interruption or blocking of the contested processing operations as well as to make any imposed fine public…So, email privacy management is serious business!

Feel free to contact our team if you require more information or want to further discuss this topic.

This article has been co-authored with Benedetta Merlini and Marco Propato.