A business has been fined EUR 25,000 (NOK 250,000) for illegal forwarding of an employee's e-mails. The name of the business has been withheld from public disclosure to protect the identities of its employees.
The background to the case is a complaint filed by someone who found that their employer started automatically forwarding e-mails.
The employer asked the employee to set automatic forwarding from their e-mail account to a shared company e-mail account. This was supposed to be for operational reasons.
In violation of regulations
Having investigated the matter, the Norwegian Data Protection Authority concluded that the business lacked a legal basis for the forwarding of e-mails. This has taken place in violation of the regulations relating to the employer’s access to e-mail accounts and other electronic material, in addition to the requirement for legal basis under the GDPR.
Nor had the business drawn up procedures for access to e-mails. The Data Protection Authority pointed out that an improvement in the procedures could prevent future instances of unlawful access.
On this basis, the Data Protection Authority has ordered the business to improve its internal control procedures and guidelines for access to employee e-mails. In addition, the business has been ordered to pay NOK 250,000 for having monitored the complainant's e-mail account without legal basis.
For further information, please contact the Norwegian DPA: international@datatilsynet.no
The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.