Twitter Logo Youtube Circle Icon LinkedIn Icon

Publishing firms

Legal Developments worldwide

New email guidelines issued by the Danish Data Protection Agency

August 2011 - Employment. Legal Developments by Norrbom Vinding Law Firm, member of ius laboris.

More articles by this firm.

Data protection
In a recent opinion, the Danish Data Protection Agency has issued general guidance on how employers should handle departing employees’ email accounts.
If an employer is using the access it has to an employee’s personal work email account, this qualifies as personal data processing. And the employer must then comply with the Danish Data Protection Act. Sometimes, the employer also has access to email addresses of former employees.
But for how long after the employee’s departure should an employer have access to the email account? And in which circumstances? These questions are addressed in a new opinion issued by the Data Protection Agency.
Eight specific guidelines
The Agency has issued 8 guidelines which will apply where no arrangement has been made between the employer and the departing employee.
  • When an employee has left and no longer has access to the personal work email, the email account should be kept active only for the minimum period possible

  • The length of the period should be determined by the departing employee’s position and function, and should not last more than 12 months

  • The employer should activate the auto reply function in the email account to inform the sender that the employee has left. The auto reply function should be activated as soon as possible after the employee has left

  • The active email account should only be used to receive emails. Private emails may be forwarded to the former employee's private email account

  • The employee’s personal email address should be removed as soon as possible from the employer’s website and other public sources of information

  • Only one or very few employees should be given access to the former employee’s personal email account

  • The Danish Data Protection Act – including its provisions on the duty to inform, access to data held, etc. – must be complied with when keeping a former employee’s email account open

  • The Agency recommends that employers consider the question of how to handle former employees’ email accounts. This question can be dealt with in the staff handbook. And the employee must be informed
The guidelines issued by the Agency apply to all former employees. The reason why an employee has left is therefore not relevant.
In addition to the Danish Data Protection Act, the provisions of the Danish Criminal Code on secrecy of correspondence etc. apply. This means, among other things, that employers are not allowed to read emails which are not work-related.
The above does not constitute legal advice and should not be relied upon as such

For more information please visit www.norrbomvinding.com