The principles governing the proper closure of a departing employee’s mailbox are now firmly established in the practice of the Belgian Data Protection Authority (DPA). Although these principles are by no means new, they continue to warrant close attention. This was once again demonstrated before the summer, when the DPA imposed two substantial fines in a decision concerning the non-compliant handling of a former employee’s professional mailbox after their departure.
The decision spans more than 60 pages and makes it clear that these principles should, by now, be well known to employers.
In the case at hand, there was no legal basis for keeping the mailbox active for more than one month after the employee’s departure. In addition, the employee had not been provided with the required information regarding the processing of their personal data.
In summary, employers are well advised to proceed as follows:
- Block the email address and email account at the latest on the last day of employment and ask the departing employee to set up an out-of-office message with prescribed wording, requesting senders to forward their email to another (active) email address.
- The retention period of the deactivated email address, combined with the automatic out-of-office reply, should in principle be one month. According to the DPA, this period may be extended (up to a maximum of three months), but only if duly justified.
- Emails received after departure on the deactivated address may no longer be accessed. If the sender required follow-up, they would resend the message to another active email address, in line with the out-of-office instructions.
It is clear that the DPA considers these principles to be well established by now and is therefore prepared to impose effective fines where they are not respected. The summer period provides an excellent opportunity for employers to review whether their internal practices comply with these principles and, if necessary, make adjustments to avoid unpleasant surprises in the future.