Information and Data Protection Commissioner
CDP/COMP/577/2023
vs
# THE COMPLAINT
1. On the 14th of May 2023, Mr [REDACTED] (the “complainant”) lodged a complaint with the Information and Data Protection Commissioner (the “Commissioner”), alleging that upon terminating his employment, the [REDACTED] (the “controller”) accessed his work email account¹, and failed to provide him with the right to clear his mailbox. The complainant stated that he had personal documents on his work email account, such as, an electricity bill on the address of the company and personal written text documents.
# INVESTIGATION
2. Pursuant to article 58(1)(a) of the Regulation, on the \(22^{\mathrm{nd}}\) of June 2023, the Commissioner requested the controller to put forward its submissions to defend itself against the allegations raised by the complainant.
3. By means of an email dated the \(10^{\text{th}}\) of July 2023, the controller submitted the following salient arguments for the Commissioner to consider during the analysis of this case:
a. that when the complainant was no longer employed with the controller, it ensured that he was no longer allowed free and unrestricted access to his work email accounts;
b. that although the complainant was never meant to make use of the work email accounts for his own private purposes, upon informing the controller that he had personal data on his work email accounts which he wanted to delete, access was duly granted to him by means of an email (email annexed and marked as 'DOC IDPC1'); and
1 [REDACTED]org.mt
Page 1 of 5
c. that by virtue of the abovementioned email, the complainant was informed that access to his work email accounts would be granted to him to be able to delete any personal data, and that following this exercise, the relative accounts would be deleted permanently, to ensure that the controller would not retain the complainant's personal data.
4. On the 14th of July 2023, the Commissioner provided the complainant with the opportunity to rebut the arguments submitted by the controller. Accordingly, on the 19th of July 2023, the complainant held that after he "was given access to my [his] work email, after I [the complainant] had been blocked out from it, I [the complainant] proceeded to delete everything from it". Furthermore, the complainant held that "my [the complainant's] suspicion was that by then the government had already snooped in into my [the complainant's] work mail".
5. In line with the Office's complaint handling procedure, the Commissioner provided the controller with the final opportunity to rebut the argument made by the complainant, and on the 2nd of August 2023, the controller held that "at no point was there any access to the email accounts pertaining to Mr [REDACTED]". It explained that in the process of carrying out the technical operation to grant the complainant access to all his email accounts, the webmaster hosting the email accounts had to access the backend of the relative mailbox, and in doing so, the webmaster realised that the data in the email accounts had already been swiped clean by a person outside of Malta. The controller held that this was admitted and confirmed by the complainant himself in the email sent on the 7th of September 2021 (email annexed and marked as 'DOC IDPC2').
6. The controller concluded that there was no illegal third-party access to the complainant's email accounts. The controller merely complied with his request to grant him with access to the email accounts.
# LEGAL ANALYSIS AND DECISION
# General Considerations
7. As a preliminary point, the Commissioner establishes that the complainant's work mailbox contains 'personal data' within the meaning of article 4(1) of the Regulation as it contains the complainant's name and surname. This was confirmed by the Court of Appeal in the case Doreen Camilleri vs Information and Data Protection Commissioner², whereby the Court held that "apparti li għalkemm l-email account huwa tal-principal, jibqa' l-fatt li l-indirizz fih isem
² Qorti tal-Appell (Kompetenza Inferjuri) Imhallef Anthony Ellul Appell numru: 63/17, 5th October 2018.
Page 2 of 5
l-appellanti li hu data personali". Consequently, when the controller processes personal data, such processing operation must comply with the appropriate legal criteria and principles established under the Regulation.
8. The Commissioner holds that, following the termination of employment of an employee, the employer shall, immediately after disabling access of the mailbox, give the employee the opportunity to keep a copy of any personal emails that might be stored in the mailbox and delete them accordingly. Subsequently, the mailbox is archived, and the account is deleted after a pre-determined timeframe that shall not be longer than necessary for the purposes for which the personal data are processed³.
9. For the purpose of handling this complaint, the Commissioner sought to investigate, the subject matter of the complaint. Thus, the Commissioner delved into an analysis to establish whether the controller had accessed the complainant's work email account in a manner to spy into his mailbox, and whether the controller failed to provide him the right to clear his mailbox from his personal data.
The allegation that the controller accessed his work email account.
10. The Commissioner noted that although the complainant had primarily alleged that the controller "broke into my [the complainant's] work email – org.mt and copied my [the complainant's] data and handed it over to the Ministry", upon providing him with the right to rebut the controller's submissions, he later declared that "my [the complainant's] suspicion was that by then the government had already snooped in into my work mail"⁴ [emphasis has been made].
11. In his assessment, the Commissioner analysed article 77 of the Regulation, which empowers data subjects with the right to lodge a complaint with a supervisory authority if he or she considers that the processing of personal data relating to him or her infringes the Regulation [emphasis has been added]. Hence the two cumulative and essential conditions to be met are that there must be processing of personal data relating to a specific individual, and secondly, the processing must infringe the Regulation. The Regulation does not contemplate for those instances where an individual has the right to lodge a complaint with the supervisory authority merely based on a suspicion [emphasis has been added].
³ Article 5.1(e) GDPR – storage limitation principle.
⁴ Email dated 19th July 2023 sent by the complainant to the Commissioner.
Page 3 of 5
12. The Belgian Data Protection Authority⁵ clarified that it is competent to dismiss a complaint when a data subject does not sufficiently prove a breach of the Regulation, and when it fails to provide concrete proof of the allegations, such as supporting documents. The Commissioner notes that during the investigation, the complainant failed to put forward any concrete evidence to support his claim, namely that third parties have illegally gained access to his work email and extracted his personal data.
13. Without prejudice to the above, the Commissioner refers to the controller’s declaration⁶ whereby he held that “at no point did any employee or official from the [REDACTED] access Mr [REDACTED] mail accounts”. The controller clarified that the webmaster hosting the email accounts gained access to the backend of the complainant’s mailbox, solely for the purpose of granting access to the complainant upon his request.
The allegation that the controller did not give him the right to clear his mailbox.
14. In his considerations, the Commissioner examined the submissions made by the controller, wherein it declared that upon the complainant’s request to gain access to his work email address to delete his personal data, such access was granted by means of an email dated 7th September 2021 (email annexed and marked as ‘DOC IDPC3’).
15. Furthermore, the complainant did not contest the controller’s declaration, and later declared that “I [the complainant] also confirm that after I was given access to my work email, after I had been blocked out from it, I [the complainant] proceeded to delete everything from it.⁷” Hence, the complainant confirmed that he was granted access to delete his personal data from his work email account.
On the basis of the foregoing considerations, the Commissioner is hereby concluding that he found no grounds to unequivocally determine that the controller infringed the provisions of the Regulation, and consequently, the allegations made by the complainant are being dismissed in their entirety.
⁵ APD/GBA (Belgium), decided 1st of June 2023, Case Number 62/2023
⁶ Submissions dated 1st of August 2023.
⁷ Ibid No. 2
Page 4 of 5