When Employment Ends, Data Duties Remain: Guidance On Email Management From The Maltese Data Protection Authority

The end of an employment relationship does not mark the end of employers' data protection obligations, especially when it comes to handling the former employee's email account. From a GDPR standpoint, this post-departure phase presents a number of legal and operational challenges that require careful attention to avoid compliance risks and potential breaches.

To assist employers in addressing these challenges, the Maltese Information and Data Protection Commissioner (IDPC) has published a set of Frequently Asked Questions (FAQs) on the Management of Employee Email Accounts (Post-Departure).

The IDPC's approach aligns with that of its European counterparts, such as the French, Belgian and Italian data protection authorities, in recognising that, while the protection of business continuity constitutes a legitimate interest for employers, such interest must be carefully balanced against the fundamental rights to data protection and privacy of employees and former