Persónuvernd - 2020010702
From GDPRhub
| Persónuvernd - 2020010702 | |
|---|---|
 | |
| Authority: | Persónuvernd (Iceland) |
| Jurisdiction: | Iceland |
| Relevant Law: | Article 5 GDPR Act no. 90/2018 on personal data protection and the processing of personal data Rules no. 837/2006 on electronic monitoring and the processing of personal information that is created during electronic monitoring |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 27.11.2020 |
| Published: | 15.12.2020 |
| Fine: | None |
| Parties: | Skeljung hf. |
| National Case Number/Name: | 2020010702 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Icelandic |
| Original Source: | Persónuvernd (in IS) |
| Initial Contributor: | n/a |
Icelandic DPA holds that the treatment of the e-mail box by the company at the time of the complainant's termination of employment did not comply with the provisions of the Icelandic Act on Data Protection and the Processing of Personal Data.
English Summary
Facts
A data subject complained to the DPA about the treatment of his e-mail account upon termination of employment with Skeljung hf. According to the complainant, his e-mail box was closed immediately after he accepted a new job offer. About a week later, he had received information that someone was replying to e-mails that had been sent to his e-mail address at Skeljungur.
Skeljungur hf. argued that the complainant was informed orally that he had the opportunity to review his personal e-mail during the notice period, as well as to delete or make a copy of a personal e-mail before leaving the company. An oral agreement had been made with the complainant that the company could forward e-mails from his mailbox to an employee in the sales department until it was ensured that all e-mails from his customers had reached the company smoothly. The complainant denied being informed orally about his rights and agreeing to such conditions.
Dispute
Holding
The DPA pointed out that Article 9 (4) of Rules no. 837/2006 lays down the procedure to be followed by the employer in case of the termination of employment. The employee shall be given the opportunity to delete or make a copy of the e-mail that is not related to the employer's activities. He shall also be instructed to activate an automatic reply from his mailbox that he has resigned. No later than two weeks later, the mailbox should be closed. It is also stated that the employer is not permitted to forward to another employee the mail that arrives in the former employee's mailbox after leaving unless otherwise agreed. As it turned out during the investigation, none of these provisions were fulfilled.
In the opinion of the DPA, the company has not demonstrated that the aim of securing its business interests could not have been achieved by other and less severe measures, such as an automatic response that the complainant had resigned and a reference to another e-mail address.
The DPA concluded that the treatment of Skeljungs hf. of the e-mail box at the time of the complainant's termination of employment did not comply with Act no. 90/2018, on personal protection and processing of personal information, and rules no. 837/2006, on electronic monitoring and processing of personal information generated by electronic monitoring.
Comment
Was not removing the e-mail account of a former employee compliant with the provisions of the Icelandic Act on Data Protection and the Processing of Personal Data?
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Icelandic original. Please refer to the Icelandic original for more details.
<!DOCTYPE html><!-- eplica-no-index --><html class=" onecol" xmlns="http://www.w3.org/1999/xhtml" lang="is"><head><meta charset="utf-8" /><meta name="generator" content="Eplica CMS - www.eplica.is" /><meta name="HandheldFriendly" content="true" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="format-detection" content="telephone=no"><title> The treatment of Skeljungs hf. on an employee's e-mail account upon retirement | Solutions | Privacy. Your information, your privacy. </title><meta property="og:site_name" content="Persónuvernd. Þínar upplýsingar, þitt einkalíf." /><link rel="shortcut icon" href="/skin/v2/pub/i/fav.png" /><link rel="canonical" href="https://www.personuvernd.is/urlausnir/medferd-skeljungs-hf.-a-tolvupostholfi-starfsmanns-vid-starfslok" /><script>if(self!=top){var ö=document.documentElement;ö.style.display='none !important';try{top.location.replace(location)}catch(e){setTimeout(function(){ö.innerHTML=''},500)}}</script><link rel="stylesheet" href="/skin/v2/pub/main.css?v1.14" /><!-- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Eplica web management system
Eplica 3 : (4 @ 1040f32)
Tags [release/4.7.1]
Project Version (master@f4c8981)
License Eplica ISP hosted solution
eplica-is-1.hugsmidjan.is::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hugsmiðjan ehf.
Tel. +354 550-0900
info@eplica.is
www.eplica.is
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --><!-- begin og: tags --><meta property="og:type" content="website" /><meta property="og:title" content="The treatment of Skeljungs hf. on an employee's e-mail account upon termination" /><meta property="og:description" content="The Data Protection Authority has ruled in a case where a complaint was made about the treatment of the complainant's e-mail account following his retirement from Skeljungur hf. The complainant was dismissed and made to work out a notice period, but before the deadline had passed, the complainant was dismissed. It was complained that his e-mail account had been closed the same day and he had not been given a chance to review it. All e-mails received in the complainant's mailbox were forwarded to another employee of the company for just over five months after his retirement. Bar Skeljungur hf. because a verbal agreement had been made with the complainant on the forwarding of the e-mail to secure the company's business interests, but this was rejected by the complainant. The company was, however, made to bear the loss for not being able to prove that such an agreement had been made. The conclusion of the Data Protection Authority was that the treatment of Skeljungs hf. in the complainant's e-mail box at the end of his employment with the company would not have complied with Act no. 90/2018, on personal protection and processing of personal information, and Article 9. rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring." /><meta name="twitter:title" content="Meðferð Skeljungs hf. á tölvupósthólfi starfsmanns við starfslok" /><meta name="twitter:description" content="Persónuvernd hefur úrskurðað í máli þar sem kvartað var yfir meðferð tölvupóstshólfs kvartanda í kjölfar starfsloka hjá Skeljungi hf. Var kvartanda sagt upp störfum og gert að vinna út uppsagnarfrest en áður en fresturinn hafði liðið var kvartanda vikið frá störfum. Kvartað var yfir því að tölvupósthólfi hans hefði verið lokað samdægurs og hann hefði ekki fengið tækifæri til að yfirfara það. Var allur tölvupóstur sem barst í pósthólf kvartanda framsendur öðrum starfsmanni félagsins í rúmlega fimm mánuði eftir starfslok hans. Bar Skeljungur hf. því við að munnlegt samkomulag hefði verið gert við kvartanda um framsendingu tölvupóstsins til að tryggja viðskiptahagsmuni félagsins en því var hafnað af hálfu kvartanda. Félagið var hins vegar látið bera hallann af því að geta ekki fært sönnur á að slíkt samkomulag hefði verið gert. Var niðurstaða Persónuverndar sú að meðferð Skeljungs hf. á tölvupósthólfi kvartanda við starfslok hans hjá félaginu hefði ekki samrýmst ekki lögum nr. 90/2018, um persónuvernd og vinnslu persónuupplýsinga, og 9. gr. reglna nr. 837/2006 um rafræna vöktun og meðferð persónuupplýsinga sem verða til við rafræna vöktun." /><meta name="twitter:card" content="summary_large_image" /><meta property="og:image" content="https://www.personuvernd.is/media/logo/personuvernd-social.png" /><meta name="twitter:image" content="https://www.personuvernd.is/media/logo/personuvernd-social.png" /><!-- end og: tags --><script>(function(f,u,c,i,t){ u[c]+=' _ js-on '+f;setTimeout(function(r,e,m,v){r=f.split(i);e=0;v=u[c]+i;while(m=r[e++]){v=v.replace(i+m+i,i)}(u[c]+i)!==v&&(u[c]=v)},8000);t=document.createElement('input');if('placeholder' in t){u[c]+=' supports-placeholders';}})('beforejsinit',document.getElementsByTagName('html')[0],'className',' ');</script><script src='https://eplica-cdn.is/req/jqreq.js'></script><script>window.Req.joinUrl+='v1.14';</script></head><!-- /eplica-no-index --><body><div class="pghead" id="pghead"><div class="wrap"><!-- eplica-no-index --><div class="brand" role="banner"><svg class="logo" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 111.91 43.46"><path fill="#444345" transform="rotate(180 20.14 25.11)" d="M19.36 17.66h2.51v15.26h-2.51z"></path><path fill="#444345" d="M23.69 26.01h2.51v10.9h-2.51zm0-8.71h2.51v6.53h-2.51z"></path><path fill="#444345" transform="rotate(180 30.7 32.745)" d="M29.92 26.39h2.51v13.08h-2.51z"></path><path fill="#444345" d="M34.25 21.66h2.51v15.26h-2.51zm0-4.37h2.51v2.18h-2.51zm-10.56-4.36h2.51v2.18h-2.51z"></path><path fill="#444345" transform="rotate(180 30.7 42.555)" d="M29.92 41.65h2.51v2.18h-2.51z"></path><path fill="#444345" transform="rotate(180 20.14 38.195)" d="M19.36 37.29h2.51v2.18h-2.51z"></path><path class="tagline" fill="#444345" d="M57.9 17.67a3.7 3.7 0 0 1 1.37.23 2.81 2.81 0 0 1 .92.62 2.51 2.51 0 0 1 .51.88 3.12 3.12 0 0 1 0 2 2.42 2.42 0 0 1-.51.88 2.53 2.53 0 0 1-.92.62 3.5 3.5 0 0 1-1.37.24h-2v3.07H54v-8.54zm-.52 4a3.22 3.22 0 0 0 .63-.05 1.51 1.51 0 0 0 .53-.18 1 1 0 0 0 .36-.39 1.63 1.63 0 0 0 0-1.32 1 1 0 0 0-.36-.39 1.52 1.52 0 0 0-.53-.19 4.23 4.23 0 0 0-.63-.05h-1.46v2.6zm10.96-4v1.58h-4.52v1.84H68v1.46h-4.18v2.1h4.62v1.59h-6.51v-8.57zm6.23 0a2.68 2.68 0 0 1 1 .19 2.34 2.34 0 0 1 .79.51 2 2 0 0 1 .5.75 2.31 2.31 0 0 1 .18.91 2.59 2.59 0 0 1-.32 1.31 2 2 0 0 1-1 .84 1.51 1.51 0 0 1 .58.29 1.71 1.71 0 0 1 .37.47 2.75 2.75 0 0 1 .21.59c0 .22.07.43.09.65s0 .3 0 .48a5.54 5.54 0 0 0 .05.56 3 3 0 0 0 .09.55 1.19 1.19 0 0 0 .2.44h-1.86a3.32 3.32 0 0 1-.2-1c0-.38-.06-.74-.11-1.08a1.68 1.68 0 0 0-.4-1 1.4 1.4 0 0 0-1-.31h-1.91v3.35H70v-8.5zm-.67 3.88a1.44 1.44 0 0 0 1-.29 1.23 1.23 0 0 0 .32-.94 1.14 1.14 0 0 0-.32-.9 1.44 1.44 0 0 0-1-.29h-2.07v2.42zm6.39 2.58a1.31 1.31 0 0 0 .42.48 1.66 1.66 0 0 0 .6.28A2.84 2.84 0 0 0 82 25a5.29 5.29 0 0 0 .54 0 2 2 0 0 0 .54-.17 1.14 1.14 0 0 0 .42-.33.82.82 0 0 0 .17-.53.77.77 0 0 0-.22-.56 1.59 1.59 0 0 0-.55-.41 6.62 6.62 0 0 0-.82-.26l-.92-.24a7.32 7.32 0 0 1-.94-.29 3.59 3.59 0 0 1-.82-.45 2.06 2.06 0 0 1-.58-.69 2.08 2.08 0 0 1-.22-1 2.25 2.25 0 0 1 .28-1.15 2.73 2.73 0 0 1 .74-.81 3.48 3.48 0 0 1 1-.48 4.6 4.6 0 0 1 1.15-.15 5.43 5.43 0 0 1 1.29.15 3.23 3.23 0 0 1 1.1.48A2.42 2.42 0 0 1 85 19a2.62 2.62 0 0 1 .29 1.27h-1.88a1.47 1.47 0 0 0-.16-.64 1 1 0 0 0-.37-.4 1.61 1.61 0 0 0-.52-.2 3.16 3.16 0 0 0-.64-.06 2.49 2.49 0 0 0-.46.05 1.15 1.15 0 0 0-.41.17 1.11 1.11 0 0 0-.31.3.9.9 0 0 0 0 .86.87.87 0 0 0 .38.29 5 5 0 0 0 .78.26l1.3.34c.16 0 .38.09.67.17a3.56 3.56 0 0 1 .84.4 2.71 2.71 0 0 1 .73.74 2.13 2.13 0 0 1 .3 1.18 2.67 2.67 0 0 1-.22 1.1 2.58 2.58 0 0 1-.68.87 3.37 3.37 0 0 1-1.12.57 5.48 5.48 0 0 1-1.54.2 5.65 5.65 0 0 1-1.37-.17 3.47 3.47 0 0 1-1.18-.55 2.67 2.67 0 0 1-.81-.95 2.8 2.8 0 0 1-.29-1.37h1.83a1.65 1.65 0 0 0 .13.7zm6.51-3.92a4.26 4.26 0 0 1 .82-1.44 4.06 4.06 0 0 1 1.33-1 4.33 4.33 0 0 1 1.77-.34 4.38 4.38 0 0 1 1.78.34 4 4 0 0 1 1.32 1 4.26 4.26 0 0 1 .82 1.44 5.15 5.15 0 0 1 .29 1.79 5 5 0 0 1-.29 1.75 4.12 4.12 0 0 1-.82 1.41 3.83 3.83 0 0 1-1.32.94 4.38 4.38 0 0 1-1.78.34 4.33 4.33 0 0 1-1.72-.35 3.87 3.87 0 0 1-1.33-.94 4.12 4.12 0 0 1-.82-1.41 5 5 0 0 1-.34-1.74 5.15 5.15 0 0 1 .29-1.79zM88.52 23a2.83 2.83 0 0 0 .4.92 2 2 0 0 0 .72.65 2.46 2.46 0 0 0 2.16 0 2 2 0 0 0 .72-.65 2.63 2.63 0 0 0 .4-.92 4.08 4.08 0 0 0 .13-1 4.34 4.34 0 0 0-.13-1.09 2.65 2.65 0 0 0-.4-.94 1.91 1.91 0 0 0-.72-.66 2.46 2.46 0 0 0-2.16 0 1.91 1.91 0 0 0-.72.66 2.84 2.84 0 0 0-.4.94 4.34 4.34 0 0 0-.13 1.09 4.08 4.08 0 0 0 .13 1zM91 14.78l-1.25 2.12h1.19l2-2.12zm7.33 2.89l3.57 5.75v-5.75h1.76v8.57h-1.88l-3.54-5.74v5.74h-1.78v-8.57zm13.56 7.91a4.7 4.7 0 0 1-5.38 0 3.26 3.26 0 0 1-1-2.59v-5.32h1.89V23a3.82 3.82 0 0 0 .06.68 1.4 1.4 0 0 0 .25.6 1.41 1.41 0 0 0 .53.42 2.34 2.34 0 0 0 .92.16 1.75 1.75 0 0 0 1.39-.45A2.12 2.12 0 0 0 111 23v-5.33h1.88V23a3.22 3.22 0 0 1-.99 2.58zM55.9 37.24l-2.78-8.57h1.94l1.9 6 1.93-6h1.95L58 37.24zm12.34-8.57v1.58h-4.52v1.84h4.15v1.46h-4.15v2.1h4.62v1.59h-6.5v-8.57zm6.23 0a2.64 2.64 0 0 1 1 .19 2.24 2.24 0 0 1 .79.51 2.17 2.17 0 0 1 .51.75A2.49 2.49 0 0 1 77 31a2.59 2.59 0 0 1-.32 1.31 2 2 0 0 1-1 .84 1.38 1.38 0 0 1 .58.29 1.54 1.54 0 0 1 .37.47 2 2 0 0 1 .21.59 3.63 3.63 0 0 1 .09.65v.48a5.46 5.46 0 0 0 0 .56 4.21 4.21 0 0 0 .09.55 1.37 1.37 0 0 0 .2.44h-1.87a3 3 0 0 1-.19-1c0-.38-.06-.74-.11-1.08a1.75 1.75 0 0 0-.41-1 1.4 1.4 0 0 0-1-.31h-1.9v3.35h-1.89v-8.47zm-.67 3.88a1.42 1.42 0 0 0 1-.29 1.19 1.19 0 0 0 .33-.94 1.11 1.11 0 0 0-.33-.9 1.42 1.42 0 0 0-1-.29h-2.06v2.42zm6.83-3.88l3.58 5.75v-5.75H86v8.57h-1.89l-3.57-5.74v5.74h-1.78v-8.57zm10.95 0a4.58 4.58 0 0 1 1.55.26 3.36 3.36 0 0 1 1.23.8 3.66 3.66 0 0 1 .82 1.32 5.42 5.42 0 0 1 .29 1.86 5.86 5.86 0 0 1-.24 1.72 3.81 3.81 0 0 1-.72 1.37 3.37 3.37 0 0 1-1.22.91 4.08 4.08 0 0 1-1.71.33h-3.69v-8.57zm-.13 7a2.34 2.34 0 0 0 .79-.13 1.7 1.7 0 0 0 .69-.44 2.2 2.2 0 0 0 .48-.79 3.53 3.53 0 0 0 .18-1.2 4.6 4.6 0 0 0-.13-1.17 2.33 2.33 0 0 0-.41-.9 1.82 1.82 0 0 0-.76-.57 3.11 3.11 0 0 0-1.17-.2h-1.35v5.4z" transform="translate(-.95 -.37)"></path><path class="hat" d="M3.45 28H1A27.63 27.63 0 0 1 42.27 4L41 6.17A25.13 25.13 0 0 0 3.45 28z" transform="translate(-.95 -.37)" fill="#376db0"></path></svg></div><div class="skiplink"><p> <a href="#content" title="Direct in content" class="withinpage">Content</a> </p><hr></div><!-- /eplica-no-index --></div></div><nav class="pgextra2" id="pgnav"><!-- eplica-no-index --><div class="mnav"
><div class="boxbody"><ul class="level1"
><li class="cat1 branch"> <a href="/einstaklingar/" class="cat1">Individuals</a><ul class="level2"
><li class="branch"> <a href="/einstaklingar/spurt-og-svarad/">Questions and answers</a><ul class="level3"
><li> <a href="/einstaklingar/spurt-og-svarad/allar-spurningar-og-svor/">All questions and answers</a></li
><li> <a href="/einstaklingar/spurt-og-svarad/rafraen-voktun/">Electronic monitoring</a></li
><li> <a href="/einstaklingar/spurt-og-svarad/almennt-um-personuvernd/">In general about privacy</a></li
><li> <a href="/einstaklingar/spurt-og-svarad/retturinn-til-ad-gleymast/">The right to be forgotten</a></li
><li> <a href="/einstaklingar/spurt-og-svarad/rettur-til-upplysinga-um-eigin-arfgerd/">Right to information about one's own genotype</a></li
><li class=" last"> <a href="/einstaklingar/spurt-og-svarad/hvad-er-vinnsla/">What is processing?</a> </li
></ul
></li
><li class="branch"> <a href="/ny-personuverndarloggjof-2018/">New privacy legislation 2018</a><ul class="level3"
><li> <a href="/ny-personuverndarloggjof-2018/almennt-um-nyju-loggjofina/">In general about the new legislation</a></li
><li class=" last"> <a href="/ny-personuverndarloggjof-2018/annad/">Another interesting topic</a> </li
></ul
></li
><li class=" last branch"> <a href="/einstaklingar/fraedsluefni/">Educational material</a><ul class="level3"
><li class="singlepage pamphlet"> <a href="/einstaklingar/fraedsluefni/baeklingur-personuvernd-barna/">Booklet: Child privacy</a></li
><li class="singlepage pamphlet"> <a href="/einstaklingar/fraedsluefni/baeklingur-einkamal-ungmenna/">Booklet: Youth Private</a></li
><li class="singlepage pamphlet"> <a href="/einstaklingar/fraedsluefni/baeklingur-almenningur/">Booklet: The public</a> </li
></ul
></li
></ul
><li class="cat2 branch"> <a href="/fyrirtaeki-og-stjornsysla/" class="cat2">Business and administration</a><ul class="level2"
><li class="branch"> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/">Questions and answers</a><ul class="level3"
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/allar-spurningar-og-svor/">All questions and answers</a></li
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/rafraen-voktun/">Electronic monitoring</a></li
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/almennt-um-personuvernd/">In general about privacy</a></li
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/adgangsrettur/">Right of access</a></li
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/abyrgdaradilar-vinnsluadilar-og-vinnslusamningar/">Guarantors, processors and processing agreements</a></li
><li> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/abyrgdarskylda/">Liability</a></li
><li class=" last"> <a href="/fyrirtaeki-og-stjornsysla/spurt-og-svarad/vinnsluskrar/">Processing files</a></li
></ul
></li
><li> <a href="/fyrirtaeki-og-stjornsysla/ny-personuverndarloggjof-2018/">New privacy legislation 2018</a></li
><li class=" last"> <a href="/fyrirtaeki-og-stjornsysla/fraedsluefni/">Educational material</a> </li
></ul
></li
><li class="log-og-reglur branch"> <a href="/log-og-reglur/log-um-personuvernd" class="cat3">Law and order</a><ul class="level2"
><li> <a href="/log-og-reglur/log-um-personuvernd/">Privacy Act</a></li
><li> <a href="/log-og-reglur/reglur-og-reglugerdir/">Rules and regulations</a></li
><li> <a href="/log-og-reglur/onnur-log/">Other laws</a></li
><li> <a href="/log-og-reglur/adrar-reglur-og-leidbeiningar/">Other rules and guidelines</a></li
><li class=" last"> <a href="/log-og-reglur/althjodasamningar-og-evropuloggjof/">International agreements and European legislation</a> </li
></ul
></li
><li class="cat4 parent branch"> <a href="/urlausnir/" class="cat4">Solutions</a><ul class="level2"
><li class="current"> <a href="/urlausnir/">Solutions</a></li
><li> <a href="/adrar-urlausnir/umsagnir/">Reviews</a></li
><li> <a href="/adrar-urlausnir/leyfisveitingar/">Licensing</a></li
><li class=" last"> <a href="/adrar-urlausnir/ymis-bref/">Various letters</a> </li
></ul
></li
><li class="cat5 branch"> <a href="/personuvernd/" class="cat5">Privacy</a><ul class="level2"
><li> <a href="/personuvernd/hlutverk-personuverndar/">The role of the Data Protection Authority</a></li
><li> <a href="/personuvernd/frettir/">News</a></li
><li> <a href="/personuvernd/starfsfolk-og-stjorn/" title="Staff and board of the Data Protection Authority" aria-label="Starfsfólk og stjórn Persónuverndar">Staff and management</a></li
><li> <a href="/personuvernd/fyrir-fjolmidla/" title="Information for the media" aria-label="Upplýsingar fyrir fjölmiðla">For the media</a></li
><li> <a href="/personuvernd/beidnir-um-kynningar/">Requests for presentations</a></li
><li> <a href="/personuvernd/vidburdir/">Events</a></li
><li> <a href="/personuvernd/stefna-og-gildi/" title="Privacy Policy and Values" aria-label="Stefna og gildi Persónuverndar">Policy and values</a></li
><li class=" last branch"> <a href="/personuvernd/arsskyrslur/">Annual reports</a><ul class="level3"
><li> <a href="/media/arsskyrslur/Arsskyrsla-2016ny.pdf">2016</a></li
><li> <a href="/media/arsskyrslur/Arsskyrsla-2015.pdf">2015</a></li
><li> <a href="/media/arsskyrslur/2014.pdf">2014</a></li
><li> <a href="/media/arsskyrslur/04_arsskyrsla_2013.pdf">2013</a></li
><li> <a href="/media/arsskyrslur/arsskyrsla-2012_loka.pdf">2012</a></li
><li> <a href="/media/frettir/Endanleg-profork.pdf">2011</a></li
><li> <a href="/media/frettir/profork-14.09.2011.pdf">2010</a></li
><li> <a href="/media/frettir/6_personuv_2010.pdf">2009</a></li
><li> <a href="/media/frettir/arsskyrsla2008.pdf">2008</a></li
><li> <a href="/media/frettir/arsskyrsla2007.pdf">2007</a></li
><li> <a href="/media/frettir/arsskyrsla2006.pdf">2006</a></li
><li> <a href="/media/frettir/arsskyrsla-2005-pdf.pdf">2005</a></li
><li> <a href="/media/frettir/arsskyrsla-2004.pdf">2004</a></li
><li> <a href="/personuvernd/arsskyrslur/2003/">2003</a></li
><li> <a href="/personuvernd/arsskyrslur/2002/">2002</a></li
><li> <a href="/media/frettir/arsskyrsla-2001.pdf">2001</a></li
><li> <a href="/personuvernd/arsskyrslur/2000/">2000</a></li
><li> <a href="/personuvernd/arsskyrslur/1999/">1999</a></li
><li> <a href="/personuvernd/arsskyrslur/1998/">1998</a></li
><li> <a href="/personuvernd/arsskyrslur/1997/">1997</a></li
><li class=" last"> <a href="/personuvernd/arsskyrslur/1996/">1996</a> </li
></ul
></li
></ul
><li class="extras branch"> <a href="/log-og-reglur/log-um-personuvernd" class="cat6">Other content</a><ul class="level2"
><li class="vefkokustefna"> <a href="/upplysingar-um-thig/">Privacy Policy</a></li
><li class="normal"> <a href="/lagalegur-fyrirvari/">Legal notice</a></li
><li> <a href="/adgengismal/">Accessibility issues</a></li
><li> <a href="/thjonustubord-personuverndarloggjafar/">Service desk</a></li
><li class="tw last"> <a href="https://twitter.com/personuvernd">Twitter</a> </li
></ul
></li
><li class="english branch"> <a href="/information-in-english/" class="cat7" title="Information in English" aria-label="Information in English">En</a><ins> glish</ins><ul class="level2"
><li class=" last"> <a href="/information-in-english/decisions/">Decisions in English</a> </li
></ul
></li
><li class="singlepage contactus"> <a href="/hafa-samband/" class="cat8">Contact</a></li
><li class="search"> <a href="/leit" class="cat9">Search</a></li
><li class="tilkynna-brot singlepage"> <a href="/tilkynna-oryggisbrest/" class="cat10">Report a security breach</a> </li
></ul></div></div><hr class="stream" /><!-- /eplica-no-index --><!-- eplica-no-index --><!-- eplica-no-index --><div class="qsearch search ac-search" role="search"><h2 class="boxhead"> Search the web</h2><form class="boxbody" action="/leit" > <span class="fi_txt req"><label for="qstr2">Enter keywords</label><input id="qstr2" name="q" value="" /></span><span class="fi_btn"><input class="submit" type="submit" value="Search" /></span> </form></div><hr class="stream" /><!-- /eplica-no-index --><!-- /eplica-no-index --></nav><div class="pg"><div class="pgwrap"><div class="navbar"><!-- eplica-no-index --><div class="snav"
><div class="boxbody"><ul class="level1"
><li class="cat1 current"> <a href="/urlausnir/" class="cat1">Solutions</a></li
><li class="cat2"> <a href="/adrar-urlausnir/umsagnir/" class="cat2">Reviews</a></li
><li class="cat3"> <a href="/adrar-urlausnir/leyfisveitingar/" class="cat3">Licensing</a></li
><li class="cat4 last"> <a href="/adrar-urlausnir/ymis-bref/" class="cat4">Various letters</a> </li
></ul></div></div><hr class="stream" /><!-- /eplica-no-index --></div><main class="pginner" id="content"><div class="pgmain"><div class="wrap"><div class="filters"><!-- eplica-no-index --><!-- eplica-no-index --><div class="psearch ac-search box" role="search"><form class="boxbody" action="/leit" ><input type="hidden" name="pid" value="1066" data-url="https://www.personuvernd.is/urlausnir/*" /><div class="fi_txt searchstr req"> <label for="qstr">Search for solutions</label> <input id="qstr" name="q" value="" placeholder="Leita í úrlausnum" /></div><div class="f_row datesearch"><div class="fi_txt datefrom"> <label for="datefrom">Year from:</label> <input id="datefrom" type="text" name="datefrom" value="" placeholder="Ár frá" /></div><div class="fi_txt dateto"> <label for="dateto">Year to:</label> <input id="dateto" type="text" name="dateto" value="" placeholder="Ár til" /></div></div><div class="fi_btn"> <button class="submit" type="submit">Search</button> </div></form></div><hr class="stream" /><!-- /eplica-no-index --><!-- /eplica-no-index --></div><!-- eplica-search-index-fields
SearchType=Article
title=Meðferð Skeljungs hf. á tölvupósthólfi starfsmanns við starfslok
subtitle=Mál nr. 2020010702
articlepublisheddate=1608043860000
eplica-search-index-fields --><!-- eplica-contentid 1-3022-MainContent --><div class="article add-print box" data-aid="3022"><!-- eplica-no-index --><div class="boxhead"> Solutions</div><!-- /eplica-no-index --><div class="boxbody"><h1> The treatment of Skeljungs hf. on an employee's e-mail account upon termination</h1><h2 class='subtitle'> Case no. 2020010702</h2><!-- eplica-no-index --><p class="meta"> <span class='date'>15.12.2020</span></p><!-- /eplica-no-index --><div class='summary'><p> The Data Protection Authority has ruled in a case where a complaint was made about the treatment of the complainant's e-mail account following his retirement from Skeljung hf. The complainant was dismissed and made to work out a notice period, but before the deadline had passed, the complainant was dismissed. It was complained that his e-mail account had been closed the same day and he had not been given a chance to review it. All e-mails received in the complainant's mailbox were forwarded to another employee of the company for just over five months after his retirement. Bar Skeljungur hf. because a verbal agreement had been made with the complainant on the forwarding of the e-mail to secure the company's business interests, but this was rejected by the complainant. The company was, however, made to bear the loss for not being able to prove that such an agreement had been made. The conclusion of the Data Protection Authority was that the treatment of Skeljungs hf. in the complainant's e-mail box at the end of his employment with the company would not have complied with Act no. 90/2018, on personal protection and processing of personal information, and Article 9. rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring.</p></div><h2 align="center"> <strong>Ruling</strong></h2><p><br> On November 27, 2020, the Data Protection Authority issued a ruling in case no. 2020010702:</p><h3 align="center"> I.</h3><h3 align="center"> Procedure<br><br></h3><h4 align="center"> <em>1.</em></h4><h4 align="center"> <em>Outline of case</em></h4><p> On December 3, 2019, the Data Protection Authority received a complaint from [A] (hereinafter referred to as the complainant) regarding the treatment of his e-mail account upon termination of employment with Skeljung hf.</p><p> By letter dated March 17, 2020, Skeljung hf. offered to provide explanations for the complaint. The answer was by e-mail on April 21, 2020. By e-mail on April 27, 2020. The Data Protection Authority requested further information from Skeljung hf. The reply was sent by e-mail on 15 May 2020. By letter dated On 26 May this year, the complainant was given an opportunity to comment on the views of Skeljungs hf. The complainant's comments were received by e-mail on 15 June 2020. By e-mail on 16 June 2020. The Data Protection Authority requested further information from the complainant and received his reply by e-mail the same day.</p><p> In resolving the case, all of the above documents have been taken into account, although not all of them are specifically described in the following ruling.</p><h4 align="center"> <em>2.</em></h4><h4 align="center"> <em>The complainant's views</em></h4><p> The complaint states that the complainant had been dismissed from Skeljungur hf. in [...] but has been forced to work out a notice period of three months or until [...]. When the complainant had accepted a job offer in [...], he immediately sent information to that effect to the human resources manager of Skeljungs hf. along with information that he would start work in a new place [...]. [Later that month] the sales manager contacted the complainant and demanded that he leave the workplace immediately, leave a mobile phone and laptop in his possession and that he should not show up again. All his access to the mailbox and other systems of Skeljungs hf. has been closed. The complainant was thus unable to set an automatic response due to his retirement. About a week later, he had received information that he was replying to e-mails that had been sent to his e-mail address at Skeljungur, and therefore no automatic response had been received. Following this, the complainant himself investigated the case and sent an e-mail to his e-mail address at Skeljung hf. and received an answer from an employee of Skeljungs hf. The complainant states that he has repeatedly contacted Skeljung hf. due to the fact that he received the answers from the employee who replied to his e-mail that he could only forward e-mails containing orders from customers. It was the human resources manager and the director of information technology who had access to the complainant's e-mail.</p><p> The complainant rejects the cause of action of Skeljungs hf. that a verbal agreement had been made with him that his e-mail could be forwarded to one employee of the sales department until it had been ensured that all e-mails had been received by the company's customers. Furthermore, the complainant rejects what is stated in the answers of Skeljungs hf. that he himself had requested that a personal e-mail be forwarded to his personal e-mail address. Finally, the complainant denies that he was informed of his right to inspect his mailbox, that he was not given the opportunity to delete or make a copy of the e-mail that was not related to the operations of Skeljungs hf.</p><h4 align="center"> <em>3.</em></h4><h4 align="center"> <em>The views of Skeljungs hf.</em></h4><p> On behalf of Skeljungs hf. is based on the fact that the complainant has been dismissed from the company [...]. On the same day, the complainant was informed orally that he had the opportunity to review his personal e-mail during the notice period. When Skeljungur hf. had become aware that the complainant had accepted a job with [another company], he had been forced to resign on the same day [...] as he had a great deal of confidential information. On the same day, the complainant was informed orally that he had the opportunity to delete or make a copy of a personal e-mail before he had to return the assets of Skeljungs hf. at the end of the day, which he did. The complainant also took a copy of a work-related e-mail without permission, which was a breach of his confidentiality obligations. […]. His job has […] involved, among other things, acquiring and maintaining business contacts and handling confidential information for the company. Great business interests were at stake for Skeljung hf. as the complainant alone handled all of the company's orders in [a specific] part of the country and most of his customers only sent orders in the spring and summer. Therefore, a verbal agreement had been made with the complainant that the company could forward e-mails from his mailbox to an employee in the sales department until it was ensured that all e-mails from his customers had reached the company smoothly. The complainant himself had requested that a personal e-mail be forwarded to his personal e-mail address, but employees are advised not to receive a personal e-mail to their work e-mail address.</p><p> It is based on the fact that Skeljungur hf. follow the rules of procedure for how the personal information of the company's employees is processed. Furthermore, the rules of procedure for the retirement of employees are followed, which, among other things, provide for the handling of e-mails in accordance with rules no. 837/2006 on electronic monitoring and processing of personal information generated by electronic monitoring. In the complainant's case, it had been necessary to deviate to some extent from Skeljung's traditional procedures for handling e-mail upon retirement, but this was considered necessary to ensure the company's commercial interests. In addition, all decisions have been made in consultation with the complainant.</p><p> In the answers of Skeljungs hf. states that the complainant's access to his e-mail account was blocked on [...]. In addition, all e-mails received were forwarded to one of the company's employees until [...] when the complainant's e-mail address was blocked and the automatic response was activated.</p><h3 align="center"> II.</h3><h3 align="center"> Assumptions and conclusion<br><br></h3><h4 align="center"> <em>1.</em></h4><h4 align="center"> <em>Scope - Responsible party</em></h4><p> Scope of Act no. 90/2018, on personal data protection and the processing of personal data, and Regulation (EU) 2016/679, cf. Paragraph 1 Article 4 of the Act, and thereby the authority of the Data Protection Authority, cf. Paragraph 1 Article 39 of the Act, covers the processing of personal data that is partly or wholly automatic and the processing by other methods than automatic of personal data that are or are to become part of a file.</p><p> Personal information includes information about a person who is personally identifiable or personally identifiable, and an individual is considered personally identifiable if it is possible to identify him or her, directly or indirectly, with reference to his or her identity or one or more factors that are characteristic of him or her, cf. 2. tölul. Article 3 of the Act and point 1. Article 4 of the Regulation.</p><p> Processing refers to an action or series of actions in which personal information is processed, whether the processing is automatic or not, cf. Number 4 Article 3 of the Act and point 2. Article 4 of the Regulation.</p><p> This case concerns the treatment of the complainant's e-mail account after his retirement from Skeljung hf. and forwarding emails from it. In this respect and in the light of the above provisions, this case concerns the processing of personal information which falls within the competence of the Data Protection Authority.</p><p> The person responsible for the processing of personal information complies with Act no. 90/2018 is named the responsible party. According to point 6. Article 3 of the Act refers to an individual, legal entity, government authority or other party who decides alone or in collaboration with other purposes and methods of processing personal information, cf. 7. tölul. Article 4 of the Regulation. As such, Skeljungur hf. be responsible for the processing in question.</p><h4 align="center"> <em>2.</em></h4><h4 align="center"> <em>Legality of processing</em></h4><p> Rules no. 837/2006, on electronic monitoring and the processing of personal information generated by electronic monitoring, was enacted in accordance with the authority in the older Personal Data Protection Act, no. 77/2000, and now apply for support in the 5th paragraph. Article 14 the current Act no. 90/2018. In Article 9 The rules contain special provisions on e-mail and Internet use.</p><p> In the 4th paragraph. Article 9 no. 837/2006 lays down the procedure to be followed by the employer when an employee retires. The provision states, among other things, that upon termination of employment, the employee shall be given the opportunity to delete or make a copy of the e-mail that is not related to the employer's activities. He shall also be instructed to activate an automatic reply from his mailbox that he has resigned. No later than two weeks later, the mailbox should be closed. It is also stated that the employer is not permitted to forward to another employee the mail that arrives in the former employee's mailbox after retirement, unless otherwise agreed.</p><p> It is undisputed in this case that an e-mail received by the complainant's e-mail address at Skeljung hf. was forwarded to another employee of the company from the time the complainant resigned [...] until the mailbox was closed [just over five months later] and the automatic response was activated.</p><p> The guarantor relies on the fact that an oral agreement was made with the complainant that the company could forward e-mails from his mailbox to one employee in the company's sales department until it was ensured that all e-mails from his customers had reached the company smoothly. Furthermore, the complainant himself had requested that a personal e-mail be forwarded to his personal e-mail address and therefore this was done. The above has been vehemently rejected by the complainant. On the part of the responsible party, it is based on compliance with the company's procedures for termination upon termination of employment. They stipulate, among other things, that the letter of resignation shall contain all information on retirement as well as information on the handling of e-mail upon retirement. The complainant's letter of resignation is available in this case, but no such information can be found in it.</p><p> All processing of personal information must also meet all the basic requirements of the first paragraph. Article 8 Act no. 90/2018, Coll. Article 5 Regulation (EU) 2016/679. Among other things, it stipulates that personal information shall be processed in a lawful, fair and transparent manner towards the data subject (cf. point 1 of the first paragraph of Article 8 of the Act), it shall be obtained for clearly stated, lawful and objective purposes. and not further processed for other and incompatible purposes (point 2) and that they shall be sufficient, appropriate and not in excess of what is necessary in view of the purpose of the processing, cf. 3. tölul. of the provision. The liability of the responsible party is also provided for in the second paragraph. Article 8 of the Act, cf. Paragraph 2 Article 5 of the Regulation, which states that the responsible party is responsible for ensuring that the processing of personal data always complies with the provisions of the first paragraph. Article 8 of the Act, cf. Paragraph 1 Article 5 of the Regulation, and shall be able to demonstrate this.</p><p> According to the above, word for word as to whether the guarantor and the complainant have entered into an agreement on the forwarding of e-mail from his e-mail box at Skeljung hf. With reference to para. Article 8 Act no. 90/2018, Coll. Paragraph 2 Article 5 of the Regulation, the responsible party will be deemed to have to bear the deficit for not being able to prove that the above agreement has been made.</p><p> It is also to be considered that according to the provisions of para. Article 9 rules no. 837/2006, the employee's mailbox shall be closed no later than two weeks after retirement. The guarantor has referred to the fact that due to the company's business interests it was necessary to keep the mailbox open longer. The aforementioned provision of rules no. 837/2006 does not specifically provide for exceptions to the rule that a mailbox shall be closed within two weeks of retirement. Furthermore, in the opinion of the Data Protection Authority, the responsible party has not demonstrated that the aim of securing the company's business interests could not have been achieved by other and less severe measures, such as an automatic response that the complainant had resigned and a reference to another e-mail address. was done when the mailbox was closed [...]. Was Skeljung hf. therefore, it is not permitted to keep the complainant's mailbox open after two weeks have elapsed since his retirement.</p><p> In view of all the above, the conclusion of the Data Protection Authority is that the treatment of Skeljungs hf. in e-mail box [A] at the time of his termination of employment with the company did not comply with Act no. 90/2018, on personal protection and processing of personal information, and rules no. 837/2006, on electronic monitoring and processing of personal information generated by electronic monitoring.<br><br></p><h2 align="center"> Ruling:</h2><p> The treatment of Skeljungs hf. on e-mail inbox [A] at the time of his retirement from the company did not comply with Act no. 90/2018, on personal protection and processing of personal information, and rules no. 837/2006, on electronic monitoring and processing of personal information generated by electronic monitoring.<br><br></p><p align="center"> In Privacy, November 27, 2020<br><br></p><p align="center"> Helga Þórisdóttir Helga Sigríður Þórhallsdóttir </p></div></div><hr class="stream" /><!-- eplica-no-index --><div class="breadcrumbs" role="navigation" aria-labelledby="crumbs05462708"><div> <strong id="crumbs05462708">You are here</strong> <a href="/" class='home'>Home</a> <i>»</i> <a href="/urlausnir/">Solutions</a> <i>»</i> <b class="current"><a href="/urlausnir/">Solutions</a></b> </div></div><hr class="stream" /><!-- /eplica-no-index --></div></div><div class="pgbottom"><!-- eplica-no-index --><p class="didithelp" aria-labelledby="helpful773244851"> <span class="didithelp__question" id="helpful773244851">Was the material helpful?</span> <a class="didithelp__answer didithelp__answer--yay button minor yay" role="button" href="#" data-thankstext="Gott að vita. Takk!">Yes</a> <a class="didithelp__answer didithelp__answer--nay button minor nay" href="/hvad-tharf-ad-laga">No</a> </p><!-- /eplica-no-index --></div></main></div><footer class="pgfoot"><div class="wrap"><!-- eplica-no-index --><div class="footer" role="contentinfo"><div class="info"><div class="brand"><svg class="logo" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 41.27 43.43"><path d="M18.36 17.27h2.51v15.26h-2.51zm5.28 8.71h2.51v10.9h-2.51zm0-8.71h2.51v6.53h-2.51zm5.28 8.72h2.51v13.08h-2.51zm5.28-4.36h2.51v15.26H34.2zm0-4.37h2.51v2.18H34.2zM23.64 12.9h2.51v2.18h-2.51zm5.28 28.35h2.51v2.18h-2.51zm-10.56-4.36h2.51v2.18h-2.51z" fill="#ffffff"/><path d="M2.45 27.6H0a27.63 27.63 0 0 1 41.27-24L40 5.77A25.13 25.13 0 0 0 2.45 27.6z" fill="#ffffff"/></svg></div><div class="about"><h3> The role of the Data Protection Authority</h3><p> The Data Protection Authority monitors compliance with laws and other rules on the processing of personal data and the correction of deficiencies and mistakes.</p></div></div><div class="contact"><div class="loc"><h3> Office</h3><p> Rauðarárstígur 10, 105 Reykjavík, Iceland<br> Open at 9-12 and 13-15<br> Lawyers' phone hours are at 10-12 Tuesdays and Thursdays<br> <span>Phone <a href="tel:+3545109600" class="tel">510 9600</a> <i>•</i></span> <span>Email <strong>address [at] personuvernd.is</strong> <i>•</i></span> <span>Id. <strong>560800-2820</strong></span> </p></div><!-- <form class="subscr" method="get" name="formMailingListRegistration" action="/postlisti">
<input id="id_1" name="SubscriptionType" value="1" type="hidden">
<div class="fi_txt fi_email req">
<input id="s_email" name="VIS_Email" value="" placeholder="Skráðu þig á póstlistann" type="email">
</div>
<p class="note"><abbr class="req" title="Ath: ">*</abbr> Við notum netfangið þitt til að senda þér fréttir tengdar persónuvernd</p>
<div class="fi_btn"><button type="submit">Skrá</button></div>
</form> --></div></div><!-- /eplica-no-index --><!-- eplica-no-index --><div class="fnav"
><div class="boxbody"><ul class="level1"
><li class="vefkokustefna"> <a href="/upplysingar-um-thig/" class="cat1">Privacy Policy</a></li
><li class="normal"> <a href="/lagalegur-fyrirvari/" class="cat2">Legal notice</a></li
><li class="cat3"> <a href="/adgengismal/" class="cat3">Accessibility issues</a></li
><li class="cat4"> <a href="/thjonustubord-personuverndarloggjafar/" class="cat4">Service desk</a></li
><li class="tw last"> <a href="https://twitter.com/personuvernd" class="cat5">Twitter</a> </li
></ul></div></div><hr class="stream" /><!-- /eplica-no-index --></div></footer></div><script async src='/skin/v2/pub/main.js?v1.14'></script><script type="text/javascript">
/*<![CDATA[*/
(function() {
if (! /(?:^|;\s*)cookie=1/.test(document.cookie)) { return; } // consent-check
var sz = document.createElement('script');
sz.type = 'text/javascript';
sz.async = true;
sz.src = '//siteimproveanalytics.com/js/siteanalyze_6103423.js';
var s = document.getElementsByTagName('script')[0];
s.parentNode.insertBefore(sz, s);
})();
/*]]>*/
</script></body></html>
