A former employee did not have the right to see emails in
his work email account with his former employer under the rules of
the GDPR because the request was too extensive.
Under the GDPR, a data controller must provide a data subject
with access to all personal data which the data controller
processes about him or her, if the data subject requests it.
However, the data controller may refuse to act on such a request,
if, for example, the scope of the request for access is
excessive.
In this case, the Danish Data Protection Agency had to decide
whether an employer was entitled to refuse to provide access to all
the contents of a former employee's work email account. The
former employee asked to see all emails sent or received via his
work email account as well as all other emails sent in the
workplace about him.
