IDPC (Malta) - CDP/COMP/577/2023
| IDPC - CDP/COMP/577/2023 | |
|---|---|
 | |
| Authority: | IDPC (Malta) |
| Jurisdiction: | Malta |
| Relevant Law: | Article 4(1) GDPR Article 77 GDPR |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | CDP/COMP/577/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | English |
| Original Source: | IDPC (in EN) |
| Initial Contributor: | Sainey Belle |
The Maltese DPA rejected a complaint due to a lack of concrete evidence of an infringement of data protection rights
English Summary
Facts
The data subject lodged a complaint with the Commissioner, alleging that his employer (the controller) accessed his work email account and failed to provide him with the option to delete all personal documents contained in such account after terminating his employment.
The controller sought to argue that, although the data subject was not permitted to use his work email for his own private purposes, access to the account had been granted after the termination, precisely to allow deletion of personal data unrelated to work. The work email was later wiped, and this was confirmed by the data subject a few months after.
Nevertheless, the data subject was of the opinion that the controller had already snooped into his mailbox.
Holding
The Commissioner held that the work email account contained the data subjects personal data, as defined in Article 4(1) GDPR, as it contained their name and surname. Consequently, when the controller processes personal data, such processing operation must comply with the appropriate legal criteria and principles established under the Regulation.
In addition, following a termination of an employment relationship, the controller shall provide the data subject the opportunity to keep a copy of any personal emails stored in the mailbox and delete them accordingly.
The data subject failed to put forward any concrete evidence to support their claim that third parties accessed his mailbox. In accordance with Article 77 GDPR, data subjects are entitled to lodge a complaint with a supervisory authority if they consider that a particular processing relating to them infringes the GDPR. The Commissioner held here that a mere suspicion that someone has infringed your rights is not enough to lodge a complaint. Other than the webmaster hosting the email accounts, it cannot be proved that any other person accessed his email accounts.
On the above basis, the Commissioner found no grounds to unequivocally state that the controller infringed the GDPR and dismissed the complaint.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
