Datatilsynet (Norway) - 20/02274
From GDPRhub
| Datatilsynet (Norway) - DT-20/02274 | |
|---|---|
 | |
| Authority: | Datatilsynet (Norway) |
| Jurisdiction: | Norway |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(e) GDPR Article 5(2) GDPR Article 6(1)(f) GDPR Article 13 GDPR Article 17(1)(e) GDPR Article 21 GDPR Article 24 GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 07.06.2021 |
| Published: | 22.06.2021 |
| Fine: | 150000 NOK |
| Parties: | n/a |
| National Case Number/Name: | DT-20/02274 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Norwegian |
| Original Source: | Datatilsynet (in NO) |
| Initial Contributor: | Rie Aleksandra Walle |
The Norwegian DPA fined a company €14,700 for unlawfully changing the password and taking over an employee's work email account during her notice period without warning her, without giving her the opportunity to delete personal content and despite her objections, in breach of several Articles as per the GDPR.
English Summary
Facts
The Norwegian DPA (Datatilsynet) received a complaint from a data subject, stating that her former employer had changed the password of and taken over her work email account during her notice (resignation) period, without letting her know, thus not giving her an opportunity, either, to delete personal content. Further, the email account wasn't deleted after she left the company.
The company ignored her request to delete the email account (which involved processing her personal data), only enabled a vacation response. In their reply to the DPA, they argued that it was necessary to keep the inbox to uphold customer relations and ensure they received necessary operational information until the former employee had been replaced.
The company didn't agree that they had accessed "personal" emails. They had forwarded two emails they sensed were personal, directly to the former employee, without opening them. In Norway, however, it's not relevant whether such emails are deemed personal or related to work - access to employees' inboxes is strictly regulated regardless.
The company didn't discontinue the former employee's email account until they received the first letter from the DPA.
The DPA noted that the unlawful access to the complainant's email account was in breach of the fundamental principles of the GDPR, notably Article 5(1)(a) and (e).
Dispute
Did the company have legal grounds to access the employee's work email account?
Holding
The DPA held that the company had accessed the employee's email account and emails without legal grounds, in breach of Article 6(1)(f) GDPR, for insufficient assessment of her protest and for continuing to process her personal data despite this and without compelling legitimate grounds, in breach of Article 21, for insufficient information, in breach of Article 13, for not discontinuing her email, in breach of Article 6(1)(f) and for insufficient erasure of the email content, breach of Article 17(1)(e). For this, the company was fined NOK 150 000 (~€14,700).
The company was also required to update their internal routines and submit a written confirmation of the latter, including documentation, to the DPA (unless they appeal the decision).
Comment
The DPA comments that the company also violated the privacy of third parties, who, in good faith, thought they sent emails to the complainant.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Norwegian original. Please refer to the Norwegian original for more details.
Page 1 RADIO GRENLAND AS PO Box 10 4301 SANDNES Offl. § 13 cf. Popplyl. § 24 (1) 2. pkt. Their reference Our reference Date 20 / 02274-9 .2021 Decisions on orders and infringement fines - Access to employees' e-mail box and lack of deletion etc. - Radio Grenland 1 Introduction We refer to our notice of decision on order and infringement fee dated 12 November 2020. We also refer to their comments on the forecast dated 9 December 2020 and 28 April 2021. These the comments are dealt with in section 7.4 of the decision. 2. Decision on order The Data Inspectorate makes the following decisions: Pursuant to Article 58 (2) (2) of the Privacy Ordinance, Radio is imposed Grenland AS, org.nr. 971 062 029, to pay an infringement fee to the Treasury on NOK 150,000 for having accessed the complainant's e-mail box without a legal basis, cf. Article 6 (1) (f) of the Privacy Regulation, for an inadequate assessment of the protest and for continued treatment without referring to compelling justifiable reasons for further processing which went beyond the interests of the data subject, cf. Article 21, for missing information, cf. Article 13, and for failure to close the e-mail box, cf. article 6 no. 1 letter f, and failure to delete the contents of the e-mail box, cf. article 17 No. 1 letter e. 2. Pursuant to Article 58 (2) (d) of the Privacy Regulation, this is imposed Radio Grenland to establish written internal control and routines for access to employees and former employees' e-mail boxes and other electronically stored material, cf. Article 24 of the Privacy Regulation. Postal address: Office address: Telephone: Fax: Company No: Website: PO Box 458 Sentrum Tollbugt 3 22 39 69 00 22 42 23 50 974 761 467 www.datatilsynet.no 0105 OSLO 06/07/21 Page 2 The deadline for implementing the order point 2 is 08.07.2021 . You must send us within this deadline written confirmation that the order has been implemented. Complainant's description of the facts The Data Inspectorate received a complaint from The complaint applies insight into mailbox, at Radio Grenland AS («Radio Grenland »). Complainants write that former employer Radio Grenland has accessed the e-mail box . This happened when the general manager at Radio Grenland changed his password email account and took over the use of this. Complainants write that this was done during the notice period without being notified and without that was given the opportunity to delete private content. Complainants also respond that the e-mail box was not deleted after the employment ended. The employment relationship ended from Complainants write that the email account was still active until without a notice of absence having been submitted. Complainants have submitted e-mails showing that the general manager of Radio Grenland has responded to an e-mail that was arrived at the complainant's e-mail box after leaving the post. The email is answered from daily manager's own email In the email from the general manager, he writes that complaints have ended and therefore has a new private email address. Complainants pointed out in an email to the general manager that has not received information about changed access to the mailbox and that this has not been discussed In the same email also poses question that the email account is not terminated and deactivated. It appears from the answer from daily leader dated that the e-mail account is kept open to maintain customer contact. In the email writes the general manager that they will post an absence report. Complainants further write that the company does not have routines for access to and settlement of the employees' e- mailbox. 4. Radio Grenland's statement Radio Grenland writes in the report that the complainants were employed by the company until his resignation It was the general manager's task to follow up on these the work tasks until a possible replacement was engaged. The general manager therefore changed the password to e- the postal account to handle customer inquiries. You write that complainants deleted all previous e-mail correspondence up to and that daily manager had access to all e-mail that came in to the e-mail box after this. In the period did the general manager lookup once a day to ensure that operational e-mail was followed up. It is emphasized that the purpose has been to take care of the business 2 Page 3 business needs to follow up customers and inquiries after complaints resigned. Incoming e-mails may have been forwarded to the general manager for follow-up. It appears from the statement that you believe that no access has been made to private e-mail, and that there is no correct that private e-mail is answered by Radio Grenland. You write that two inquiries were forwarded to complaints without being opened, as they appeared in the headline to be private. After complainants contacted and asked questions about access it was implemented automatic absence notification informing that the complainant was not employed by the company and that Inquiries to the relevant email address would not be answered by . From and until the e-mail box was deleted, there have been no active lookups or active use of the account. The account has had an automatic absence notification for incoming correspondence. The It appears that the e-mail box has been active until you received a letter from us in January 2020. Furthermore, you write that Radio Grenland does not have written guidelines for access or settlement of e- mailbox, and that you do not have written guidelines for using the company's e-mail box for private use correspondence. You point out that you do not inspect the e-mail boxes of employees without special needs based on the business' business operations, and that such circumstances were the basis for the complainant mailbox was not immediately deleted. 5. Regulatory requirements 5.1 Regulations on the employer's access to the e-mail box, etc. Regulations on the employer's access to e-mail boxes and other electronically stored material1 (e- the Postal Regulations) regulates the employer's access to access or monitor the employee's e-mail mailbox or other electronic stored material. The regulations are a special regulation of the requirement for basis for processing in the Privacy Regulation, Article 6, paragraph 1, letter f, cf. Article 88. It follows from the preparatory work for the Personal Data Act of 20182 that the e-mail regulation is intended to continue the special rules for the employer's access to the employee's e-mail box, etc. which followed it now repealed the Personal Data Regulations from 2000.3 This means that previous practices related to the employer's access to the e-mail box in accordance with the Personal Data Regulations 2000 will be relevant for the interpretation of the rules in the e-mail regulations. This applies, among other things, to the Data Inspectorate and the Privacy Board practice. The Ministry of Local Government and Modernisation's comments on the Personal Data Regulations 2000 will also be relevant.4 The e-mail regulations specify which purposes the employer can access, and that access can only done in individual cases for specific purposes. The regulations apply to both current and past employees, cf. section 1, third paragraph. 1 FOR-2018-07-02-1108. 2 Prop.56 LS (2018-2018) section 31.3.4.2 «The Ministry's assessment». 3 FOR-2000-12-15-1265, chapter 9. «Access to e-mail box etc.». 4 Tidl. Ministry of Government Administration and Reform, see https://www.regjeringen.no/globalassets/upload/fad/vedlegg/personvern/epostforskriften_merknader_rev.pdf?id=2176744 3 Page 4 For access to e-mail, § 2 first paragraph shows that a broad category of interests related to the employer business can be legitimate. Both "the day-to-day running" and "other legitimate interests of the business ”is mentioned as a legitimate purpose, after letter a. Another group of legitimate interests is mentioned in letter b. This applies to "reasonable suspicion" that the use of e-mail or other electronic equipment constitutes a gross breach of obligations in the employment relationship or provides grounds for dismissal or dismissal. It follows from established practice that automatic forwarding of e-mails is considered access regardless of whether the email is opened and read or not.5 The forwarding in itself means that access is made to information about the sender and subject field, provided that the employer is inside the mailbox as the e-mails has been forwarded to. The Privacy Board has further determined that automatic forwarding of e-mails constitutes a continuous monitoring of employee mailbox. Forwarding can therefore not be authorized in section 2 first of the regulations paragraph, as the provision only allows for individual access for specific purposes, cf. The Privacy Board's decision PVN-2018-16. Automatic forwarding of e-mails is regulated in section 2, second paragraph, of the regulations. The provision stipulates that the employer does not have the right to monitor the employee's use of electronic equipment, unless the purpose with monitoring is to manage the company's computer network or to uncover or solve network security breaches. 5.2 Basis for processing in accordance with the Privacy Ordinance Forwarding and access to a former employee's e-mail box constitutes a processing of personal data, and is therefore covered by the general rules in the Privacy Ordinance, cf. the Privacy Ordinance Article 4 No. 2 and the Act on the processing of personal data of 15 June 2018 No. 38 (Personal Data Act) § 1. Article 6 (1) of the Privacy Regulation requires that all processing of personal data has a basis for treatment. When a business should access the mailbox through forwarding is Article 6 (1) (f) of the relevant basis of treatment, supplemented by the special regulation in Postal Regulations § 2. Article 6 (1) (f) of the Privacy Regulation provides that an undertaking may process personal data if it is necessary to safeguard a legitimate interest that outweighs consideration for the privacy of the individual. The legitimate interest must be legal, clearly defined in advance, real, and objectively justified in the business. 5.3 Duty to provide information Pursuant to Article 13 of the Privacy Regulation, the controller shall provide the registered information about the processing at the time of collection of the personal data. The information that the data controller must provide follows from Article 13 letters a to f. The person responsible for processing is obliged, among other things, to provide information about the purpose with the intended treatment and the legal basis for the treatment. 5 See PVN-2015-14 and PVN-2018-16. 4 Page 5 The duty to provide information is also regulated in the E-mail Regulations § 3. The provision lays down procedural rules for access to the e-mail box and requires, among other things, that the employee be notified and received as far as possible opportunity to comment before the employer carries out an inspection. In addition, the provision stipulates what a such notice shall contain. 5.4. Closing of employee's e-mail box It follows from the e-mail regulations § 4 first paragraph that the employee's e-mail box shall be terminated by termination of employment, but unless there is a «special need to keep the e-mail account open in a short period after the termination ». 5.5. Deletion of information upon termination of employment Article 17 (1) of the Privacy Regulation stipulates when the data controller is to delete personal information. The provisions that are relevant to our case are that the personal data must deleted if they are no longer necessary for the purpose for which they were collected or processed, cf. letter a, or when the information must be deleted in order to fulfill a legal obligation persons responsible for processing are subject, cf. letter e. The e-mail regulations § 4 second paragraph stipulates that information as mentioned in the regulations § 1 first paragraph letters a and b, which are not necessary for the daily operation of the business, shall be deleted within a reasonable time time after the end of the employment relationship. The starting point according to the provision must be that the employer must delete the information in the employee's e-mail. mailbox unless there are specific reasons for further storage. The employer has a certain room to establish a deletion deadline as long as it appears to be adequate and reasonable, but which as a general rule, deletion should take place within six months of resignation. 5.6. Internal control According to Article 24 of the Privacy Ordinance, all companies are obliged to be able to demonstrate that they process personal data in accordance with the law. If it stands in a reasonable relation to the treatment activities, the enterprise shall establish appropriate guidelines for the protection of personal information. Access to an employee's or former employee's e-mail box is an intrusive treatment of personal information, and constitutes a major interference with individuals' right to privacy. Businesses must therefore be able to document their internal routines or processes, which meet the requirements for access to e- mailboxes and other electronic material. 6. The Data Inspectorate's assessment 6.1 Legal basis for access to e-mail made available to the employee for use at work You confirm in the statement that the general manager has logged in to the e-mail box once a day during the period You writes that the background for the postings that were made was operational, and it is emphasized that it is not posted in, or opened e-mail that the employer understood from the headline was of a private nature. 5 Page 6 The e-mail regulations apply to access to information stored in e-mail boxes provided to employees disposition. All e-mail to the complainant's e-mail address is thus covered by the rules on access to the e-mail regulations. It does not matter if the emails are private emails or emails to complaints by virtue of score. The employer is therefore not free to take over such an e-mail address when an employee leaves the company, but must comply with the terms of the e-mail regulations in order to access to work-related emails. We assume that you have accessed information stored in the complainant's e-mail box on a daily basis The manager has changed the password on the email account and logged in every day for a period of 6 weeks. The question becomes so if you had a legal basis in the e-mail regulations to access the complainant's e-mail box. Section 2, first paragraph, letter a, of the E-mail Regulations refers to the fact that access can be justified in that it is necessary to look after the day-to-day operations or other legitimate interests of the business. By necessary is meant that transparency must be a proportionate tool to achieve the purpose, which is to take care of the daily the operation or other legitimate interests of the business. This depends on a specific assessment. Access to this condition can, for example, be made if you are waiting for a specific contract with a card deadline and employee is not available due to illness. In this case, you have made access for the purpose of taking care of the daily operation of the business and to maintain customer contact. These are legitimate purposes that may justify transparency. The inspection was made by the general manager changing the password and taking over the handling of the complainant's incoming email in full. It appears from your statement that the general manager had access to the e-mail box from and until you received a letter from us in January 2020. This is a period of You write, however, that the approach has only been used during the period This is a period of 6 weeks. During this period, the general manager checked the e- the mail account once a day. There are other less intrusive measures that can serve the same purposes. To take care of customer contact when an employee leaves, you can send an outgoing e-mail with information about new contact person in the company before the person leaves. If you have a special need to keep e-mail box open, an absence notice can be entered informing that the person ends and who is the new contact person. Individual inspections every day for six weeks appear comparison not as a proportional tool to achieve the purpose. Based on this, it is our assessment that changing the password and logging in every day is not necessary to maintain customer contact when an employee leaves. Our conclusion is therefore that you did not have legal basis in the e-mail regulations § 2 first paragraph letter a to make access to the complainant's e-mail box. We are further of the opinion that taking over the complainant's e-mail account borders on monitoring workers' use of electronic equipment. The Privacy Board, for example, has determined that automatically e-mail forwarding constitutes a continuous monitoring of the employee's e-mail box. That to possess the password and log in every day can be similar to automatic forwarding. So continuously monitoring may not be authorized in section 2, first paragraph, of the regulations on access, but must be authorized in the e-mail regulations § 2 second paragraph letter a or b, cf. PVN-2018-16. 6 Page 7 Monitoring a former employee's e-mail box to take care of day-to-day operations does not meet the exceptions in the e-mail regulations § 2 second paragraph. Our conclusion is therefore that Radio Grenland also had no authority in the e-mail regulations § 2 other paragraph to take over the complainant's e-mail box. Overall, Radio Grenland had no legal basis in the e-mail regulations for access or monitoring the complainant's mailbox. The e-mail regulations are a special regulation of the requirement for a basis for processing in the Privacy Ordinance Article 6, paragraph 1, letter f (balancing of interests), cf. Article 88. When the regulations prohibit access and monitoring is broken, this means that the company did not have a basis for treatment after Article 6 (1) (f) of the Privacy Regulation. Our conclusion is that Radio Grenland has had access to the complainant's e-mail box without any basis for processing, cf. the Privacy Ordinance, Article 6, No. 1, letter f. 6.2 Duty to provide information Pursuant to Article 13 of the Privacy Regulation, complainants should have received information about the takeover of the mailbox at the time this processing of personal data started. Pursuant to section 3 of the e-mail regulations, the employee shall, as far as possible, be notified and given the opportunity to comment. before inspection. We do not see that the procedural rules in the e-mail regulations § 3 have been followed, including that complaints have been given information that the employer changed the password and took over the account. This happened when complaints were and it appears that the complainants were informed that the employer still had access to e-mail then one of contacts received a response from the general manager by e-mail that was addressed to . On the basis of this, we find it clear that Radio Grenland has violated the duty to provide information pursuant to the article 13. 6.3 Closing of the employee's e-mail box To be able to continue to process personal information by keeping the e-mail box open after termination of employment, the employer must have a basis for treatment in accordance with the Privacy Ordinance Article 6 and fulfill the additional conditions in the e-mail regulations § 4. The relevant processing basis in the case is Article 6 No. 1 letter f. Section 4 of the E-mail Regulations stipulates that the employee's e-mail box shall be terminated at the employment relationship termination, unless there is a "special need" to keep the email account open for a short period after the cessation. The starting point is therefore that the e-mail account must be terminated upon termination of employment. That means that the e-mail box must be deactivated so that it is no longer possible to send or receive e-mail. Whoever sending an e-mail to the relevant address will then receive an error message stating that the e-mail cannot be delivered. 7 Page 8 Exceptionally, if there are special reasons, for example when an employee is fired or fired other reasons must end at short notice, the account can be kept open with absence notice for a short period, so that, for example, customers who make contact are informed that the person has left and that they must turn to another. The prerequisite in such situations is that the incoming e-mail is not read or sent to others in the business. In the present case, Radio Grenland has kept the complainant's e-mail box open for a period of You justify this with the fact that it was necessary to capture inquiries from customers for whom complaints were responsible. However, it appears from the statement that autoresponder was not activated before resigned. You write in the statement that the e-mail box was closed and the content deleted in January 2020, after the Data Inspectorate took contact. You have kept the complainant's e - mail box open resigned, of which the first the month was without auto-reply with information about resigned. Our assessment is that you have held the complainant's e-mail box is open beyond the short period for which section 4 of the e-mail regulations opens. 6.4 Deletion of the contents of the complainant's e-mail box The e-mail regulations § 4 second paragraph stipulates that information in the employee's e-mail box that is not necessary for the day-to-day running of the business, shall be deleted within a reasonable time after the employment relationship end. The starting point according to the provision is that the employer must delete the information in the e-mail box unless there are specific reasons for further storage. What is a reasonable time must be considered specifically, but it must be expected that the employer has made an assessment within a six month period period after the termination of the employment relationship. The employer has a certain amount of leeway to establish one deletion deadline as long as it appears adequate and reasonable, but as a general rule deletion should take place within six months from resignation. In our case, Radio Grenland has not established a separate deletion deadline for content in the employee's e-mail box, and has kept the mailbox open You state that the complainant deleted all e-mail in the e-mail box before leaving. You write that you used the mailbox until After this, the e-mail box was kept open with auto-reply, and transparency was not made. At this time, incoming emails were handled by the general manager for more than one month. You write that the e-mail account was closed when the Data Inspectorate contacted. We can not see that there were specific reasons for further storage of the contents of the complainant's mailbox through the long the period after the employment ended. On this basis, we conclude that you have breached your obligation to delete the content of the complainant's e-mail. mailbox according to the Privacy Ordinance Article 17 and the e-mail regulations § 4 second paragraph by storing the contents of e-mail box 6.5 Right to protest It follows from Article 21 of the Privacy Ordinance that the data subject has a right to protest processing of personal data based on Article 6 (1) (e) or (f). 8 Page 9 If the data subject protests, the data controller must make a specific balance of interests where the special individual circumstances of the data subject are taken into account protested. Only if the result of the sharpened balance of interests goes into it in favor of the person responsible for treatment, the treatment can be initiated or continued. The consequence of the data subject protesting is that the data controller can no longer process the personal data. The treatment can still be initiated or continued if it the person responsible for processing can prove that there are compelling justifiable reasons that precede it the interests, rights and freedoms of the data subject, cf. art. 21 No. 1 second sentence. According to the wording, it is up to the data controller to make this sharpened balance of interests. It is the data controller who has the burden of proof, not just because it is weighty reasons, but also because these reasons outweigh the interests of the data subject. If it registered protesters and the conditions for further processing are not met, the processing must be interrupted if it has already been initiated. In our case, complainants have protested by contacting Radio Grenland by e-mail with questions about the legality of the access and questions about why the e-mail box was not closed. It was then submitted an absence report, and the general manager has not logged in after the complainant got in touch. E- the postal account was still kept open until Radio Grenland received a letter from us. In response to complaints writes you that you are sorry experience of the case, but that the e-mail was kept open in order to take care of it customer contact. As assessed above in sections 6.1, 6.3 and 6.4, the Data Inspectorate has assessed that there was no separate need to keep the e-mail account open and that it was not necessary to process information in the complainant's e-mail mailbox to take care of daily operations. Our conclusion is that Radio Grenland cannot prove that there were compelling justifiable reasons for this the processing that exceeded the data subject's interests and has not fulfilled its duty to assess the complainant protest. 6.6 The duty of internal control You state that you do not have written routines for accessing the e-mail box or for closing it former employees' mailbox. Our assessment is that you should create written routines for processing personal data in connection with access to and deletion of employees or former employees' e-mail box. We point out that Radio Grenland did not fulfill its duty to provide information and that the case shows a lack knowledge of the regulations, including that the company believes that the takeover does not constitute access to e- mailbox. A written routine will make the business more aware of its obligations privacy regulations and contribute to compliance with the regulations. 9 Page 10 The takeover of the complainant's e-mail box was in breach of the duty to provide information, the requirement to basis for processing, the rules on termination of e-mail box and the deletion obligation. This indicates that Radio Grenland should establish written routines in accordance with Article 24. Based on this, we conclude that Radio Grenland had not implemented sufficient organizational measures to ensure and demonstrate that the treatment is carried out in accordance with the Privacy Regulation at the time of the inspection, cf. Article 24. Pursuant to Article 58 (2), letter d, we have the authority to order the person responsible for processing to ensure that the treatment activities take place in accordance with the provisions of the Privacy Regulation. The written routines must reflect the general requirements for processing personal information in the Privacy Ordinance, as well as the special regulation in the e-mail regulations. You will find more information about the requirement for internal control, as well as tools and templates on our websites: www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/informasjonssikkerhet- internal control. 7. Infringement fee 7.1 General information on infringement fines Infringement fees are a tool to ensure effective compliance and enforcement of the personal data regulations. We believe it is necessary to respond to the violations, and hereby notify the imposition of infringement fee, cf. Article 83 of the Privacy Ordinance. In accordance with the case law of the Supreme Court (cf. Rt. 2012 page 1556) we assume that the infringement fine is to be regarded as a penalty under the European Article 6 of the Convention on Human Rights. A clear overriding probability is therefore required for offenses to be able to charge a fee. The case and the question of imposing an infringement fee have been considered starting point in this evidentiary requirement. In this connection, reference is made to Chapter IX of the Public Administration Act on administrative sanctions. With a administrative sanction means a negative reaction that can be imposed by an administrative body, which corrects against a committed violation of law, regulation or individual decision, and which is considered a punishment under the European Convention on Human Rights (ECHR). For companies, the guilt assessment is unique. Section 46, first paragraph, of the Public Administration Act states: "When it is stipulated in law that an administrative sanction may be imposed on an enterprise, the sanction is imposed even if no individual has shown guilt ». In Prop. 62 L (2015-2016) page 199 it is stated about § 46: "The wording that 'no individual has shown guilt' is taken from the section on corporate punishment in the Penal Code § 27 first paragraph and shall be understood in the same way. The responsibility is therefore as a starting point objectively ». 10 Page 11 7.2 Assessment of whether an infringement fee is to be imposed The right to impose infringement fines is provided as a tool to ensure effective compliance and enforcement of the Personal Data Act. It follows from Article 83 (1) of the Regulation that each the supervisory authority shall ensure that the imposition of infringement fines in each individual case is "Effective, proportionate and dissuasive". This means that a concrete, discretionary assessment must be made in each individual case. The Data Inspectorate believes it is necessary to react to the violations. In the assessment, we have emphasized the conditions of Article 83 (2) of the Regulation. The provision contains statutory elements for our exercise of discretion. In the following, we will review the terms that are relevant to the facts in this case. a) the nature, severity and duration of the infringement, taking into account the person concerned the nature, extent or purpose of the treatment as well as the number of data subjects affected, and the extent of the damage they have suffered, The violation violates the basic requirements for legality, information and deletion when processing personal data. A continuous view of incoming e-mail to a former the employee's e-mail box is a serious intrusion on the person's privacy. Inspections have been made each day for a period of 6 weeks. During this period and until January 2020, all incoming e-mail has been available to the general manager. You confirm in the statement that e-mails have been read and answered. Plus two emails have been forwarded to complainants. The actions also appear to be a violation of the privacy of third parties who in good faith have sent e- mail for complaints. Correspondence to a personal e-mail address contains information individuals has a high expectation that others will not have access to it without further ado. Radio Grenland has continued the illegal access despite protests from complainants The access did not cease until you received a letter from the Norwegian Data Protection Authority asking questions practice. You have also not been informed that the access was available. According to complainants, it was coincidental that gained knowledge of the general manager's access via third parties who received replies by e-mail to complaints from daily leader himself. These did so note that the general manager had access to e-mail. The illegal access is a violation of the basic principles of legality, transparency and storage restriction for the processing of personal data, cf. Article 5 (1) of the Privacy Regulation letters a and e. When basic rules for the protection of former employees' privacy are infringed as it is in this case, the violations must be considered serious. b) whether the infringement was committed intentionally or negligently, We also place great emphasis on the degree of guilt. It is clear that both ongoing access to the e-mail box and failure to close and delete the mailbox has been a conscious choice on their part. (d) the degree of responsibility of the controller or processor, taking into account the technical and organizational measures they have implemented in accordance with Articles 25 and 32, 11 Page 12 On the basis of the report, it appears that you have little or no knowledge of the regulations and the obligations arising therefrom. The principle of accountability presupposes a strong anchoring of the regulations in companies' management, cf. Article 5 (2) of the Privacy Ordinance therefore exacerbates the fact that the forwarding was initiated by the general manager. Furthermore, we emphasize that you did not have organizational measures in the form of routines to ensure compliance with the regulations. f) the degree of cooperation with the supervisory authority to remedy the infringement and reduce the possible negative effects of it, The e-mail account was closed after you received the inquiry from us, but beyond this it appears as that you think the access to the e-mail inbox was legal as one did not read, but only forwarded e-mails of a private nature. In other respects, you have contributed to the enlightenment of the case through the report. g) the categories of personal data affected by the infringement, According to the information, special categories of personal data are not affected by the violations in the case. Correspondence to a person's email address is, however, at the core of the right to privacy and Incoming e-mails must be considered as information worthy of protection. This draws in aggravating direction. k) and any other aggravating or mitigating factor in the case, e.g. economic benefits that are achieved, or losses that have been avoided, directly or indirectly, as a result of the violation In the present case, you have chosen to satisfy the need to take care of the daily operations of one very intrusive way, which goes far beyond what the regulations allow for. In the aggravating direction draws that the violations continued despite protests from complaints and questions about why the general manager continued had access to e-mail box. 7.3 Conclusion Following this, the Data Inspectorate has come to the conclusion that an infringement fee should be imposed, cf. the Privacy Ordinance Article 83 (2) and (5). 7.4 Assessment of the size of the fee When measuring the size of the fee, emphasis shall be placed on the same assessment factors as in the question of whether a fee should be imposed. We therefore refer to the assessments of the seriousness of the case above. The violation fee must be effective, be in a reasonable proportion to the violation and work deterrent. This means that the supervisory authority must make a concrete, discretionary assessment in each case. The fee should be set so high that it also has an effect beyond the specific case, at the same time as the fee size must be in a reasonable proportion to the infringement and the activity, cf. Article 83 no. 1. 12 Page 13 The Privacy Ordinance facilitates a higher level of fines than that which applied thereafter the Personal Data Act of 2000, and it follows from Article 83 (1) of the Regulation that an infringement fee shall be determined concretely so that in each individual case is effective, is in a reasonable relation to the violation and acts as a deterrent. The main purpose of the infringement fee is contraception, ie that the risk of being charged a fee shall have a deterrent effect and thereby contribute to increased compliance with the regulations.6 By Skullerud et al. (2019), page 347, it appears: Contraceptive considerations dictate that the fee for a violation must be set so high that this is in fact perceived as an evil by the offender. This means that the offender's financial capacity should have significance in the measurement, so that the fee becomes higher the stronger the carrying capacity of the offender hair. […] When assessing the financial sustainability of an enterprise, it may be relevant to look at the enterprise's total global annual turnover in the preceding financial year, cf. art. 83 Nos. 4 and 5. And further: The consideration of ensuring an individual assessment in each individual case dictates that the supervisory authorities should avoid establishing standardized fee rates. This applies even if national law allows for it standardized rates, cf. the Public Administration Act § 43. Article 83 (5) of the Privacy Ordinance sets a higher maximum amount for fees when the case concerns violations of the basic principles of the processing of personal data in accordance with Articles 5 and 6 of the Privacy Regulation. Our case concerns a lack of basis for processing (the principle of legality), a breach of the duty to provide information (the principle of transparency) and the obligation to delete (the principle of storage limitation), which constitute serious breaches on the Privacy Regulation. In addition, the company lacked organizational measures for compliance the regulations (the principle of accountability). This speaks for a fee of a certain size. In an aggravating direction, we place particular emphasis on the fact that the takeover of the e-mail account was initiated by the general manager of the company, that the access lasted for a long time despite objections from complaints, that e- the items were answered from the complainant's account, and that the company's management lacked knowledge of the regulations. The fee must be set so high that it is effective and achieves a sufficient deterrent effect. IN In measuring the size of the fee, we therefore also place emphasis on the company's finances. Radio Grenland's comments on the size of the notified infringement fee are therefore relevant the measurement. Radio Grenland has made several comments about the company's finances related to the ongoing one changed the situation as a result of the Covid-19 pandemic. Radio Grenland informs that the business has made layoffs of and in the last year to adapt to a challenging market situation as a result of the ongoing pandemic. It is pointed out that Radio Grenland is a company with only five employees in a competitive industry and that you are dependent on advertising revenue to have 6 Skullerud et al. (2019). 13 Page 14 basis of operation. Furthermore, you point out that the jobs at the company are threatened if a fee in one the order of magnitude imposed on the business in the notification. The notified infringement fee of NOK 200,000 has been measured according to the latest available accounting figures from 2019 at the time of the notice. In 2019, Radio Grenland had registered operating revenues of 6,554,000 kr. Radio Grenland has submitted preliminary accounts for 2020 and so far in 2021, see document number 20 / 02274-12. The accounts show that Radio Grenland had registered revenues of 4,970,236 up to period 12 2020. So far this year, the business has had revenues corresponding to approx. 65% of revenues in the same period last year. In comparison, Radio Grenland had an operating income of NOK 6,554,000 in 2019 and a annual profit of NOK 111,000 in 2019. The fall in turnover from 2019 to 2020 thus amounts to approx. 25%. Based on the financial situation the company is in as a result of coronary pandemic, our assessment is that a lower fee could have the preventive and deterrent the effect Article 83 presupposes. After taking into account the seriousness of the violations and Radio Grenland's comments, the Data Inspectorate sets it the final fee to NOK 150,000. We have hereby reduced the notified fee of NOK 200,000 by approx. 25%, corresponding to Radio Grenland's revenue decline between 2019 and 2020. We remind you that violations of Article 6 of the Privacy Regulation may result in sanctions in the form of infringement fines of up to EUR 20 million, see Article 83 (5) (a) of the Privacy Regulation. This corresponds to approx. NOK 214,000,000. The fee imposed in this case is thus at the very bottom layer of what the regulation prescribes for such breaches of regulations. 8. Right of appeal This is an individual decision that can be appealed in accordance with the rules of the Public Administration Act, cf. the Public Administration Act § 28. Any complaint must be sent to us within three weeks after this letter has been received, cf. the Public Administration Act § 28 and 29. If we uphold our decision, we will send the case to the Privacy Board for appeal processing, cf. the Personal Data Act § 22. If you do not appeal the decision on the infringement fee, the deadline for fulfillment is 4 weeks after the expiry of the appeal period, cf. the Personal Data Act § 27. Recovery of the claim will be carried out by State Collection Agency. 9. Publicity, transparency and duty of confidentiality We will inform you that all the documents are in principle public, cf. the Public Access to Information Act § 3. If you believe there are grounds for exempting all or part of the document from public access, please we you to justify this. The Norwegian Data Protection Authority has a duty of confidentiality regarding who has complained to us, and about the complainant's personal circumstances. The duty of confidentiality follows, among other things, from the Personal Data Act § 24 and the Public Administration Act § 13. As a party 14 Page 15 in the case, you may nevertheless be made aware of such information by the Norwegian Data Protection Authority, cf. the Public Administration Act § 13 b first paragraph no. 1. You also have the right to access the case documents, cf. the Public Administration Act § 18. We point out that you have a duty of confidentiality regarding information you receive from the Norwegian Data Protection Authority about the complainant's identity, personal circumstances and other identifying information, and that you can only use these the information to the extent necessary to safeguard their interests in this case, cf. Public Administration Act § 13 b second paragraph. We also point out that breach of this duty of confidentiality can be punished according to the Penal Code § 209. If you have any questions, you can contact legal adviser Anne Eidsaa Hamre on telephone 22 39 69 76. With best regards Jørgen Skorstad department director Anne Eidsaa Hamre legal adviser The document is electronically approved and therefore has no handwritten signatures false 15
