APD/GBA (Belgium) - 01/2026
From GDPRhub
| APD/GBA - 01/2026 | |
|---|---|
 | |
| Authority: | APD/GBA (Belgium) |
| Jurisdiction: | Belgium |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1)(f) GDPR Article 15 GDPR Article 17(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 06.01.2026 |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 01/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | APD (in NL) |
| Initial Contributor: | dt |
The DPA reprimanded an employer for unlawfully maintaining the email accounts of a former employee and for a failure to comply with the employee’s access and deletion requests.
English Summary
Facts
A former employee (the data subject) discovered in 2021 that their two professional email addresses were still active almost two years after leaving their former place of work (the controller).
The controller specified that the measure was necessary for the technical functioning of the email infrastructure and that it took sufficient technical measures to ensure to protection of the data subject's personal data.
Moreover, the controller rejected the data subject’s request to access the email accounts.
The data subject filed a complaint with the Belgian DPA.
Holding
The DPA found that the controller violated Article 5(1)(a) GDPR and Article 6(1)(f) GDPR by processing the data subject’s professional email addresses without a legitimate interest, and, therefore, also without a legal basis.
The DPA noted that for a reasonable period of time the controller had an interest in this processing in order to ensure the functioning of the company. However, after that point in time, the DPA found that the controller based its processing on a new legitimate interest, specifically the avoidance of cluttering up its servers. However, the DPA considered the processing unnecessary in this case.
Furthermore, the DPA found that the controller violated Article 15 GDPR by not allowing the data subject to access the email addresses while they were still active.
Finally, the DPA found a violation of Article 17(1) GDPR due to the failure of the controller to delete all of the data subject’s personal data.
Therefore, the DPA issue a reprimand to the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
1/21
Dispute Resolution Chamber
Decision on the merits 01/2026 of 6 January 2026
File number: DOS-2022-01908
Regarding: the continued existence of two personalized email addresses after the
acquisition of a company
The Dispute Resolution Chamber of the Data Protection Authority (hereinafter ‘DPA’);
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), hereinafter ‘GDPR’;
In view of the Act of 3 December 2017 establishing the Data Protection Authority,
hereinafter “WOG”;1
In view of the internal rules of procedure, as approved by the House of
Representatives on 20 December 2018 and published in the Belgian Official Gazette on
15 January 2019;
In view of the documents in the case file, the submissions of the parties, the hearing of 6 May 2025,
the supplementary submissions of the parties, and the parties' responses to these supplementary
Submitted the following decision regarding:
Complainant: X, represented by Mr. Robbie Tas, hereinafter “the complainant”;
Defendant: Y, represented by Mr. Edwin Jacobs and Mr. Jolien Clemens, hereinafter “the
Defendant”.
1
The Belgian Data Protection Authority (DPA) recalls that the Act of 25 December 2023 amending the Act of 3 December 2017 establishing the Data Protection Authority (DPA), and the new internal regulations of the DPA, entered into force on 1 June 2024. The new provisions apply to complaints, mediation files, requests, inspections, and proceedings before the Dispute Resolution Chamber that commence from this date. The new DPA is available via this link:
https://www.ejustice.just.fgov.be/cgi loi/change lg.pl?language=nl&la=N&cn=2017120311&taene nahetwet,
the internal regulations via this link: < https://www.gegevensbeschermingsautoriteit.be/publications/reglement-van-
interne-orde-van-de-gegevensbeschermingsautoriteit.pdf>. However, files initiated before June 1, 2024, of which this file is a part,
are subject to the provisions of the WOG and the internal rules of procedure as they
existed before that date. Decision on the merits 01/2026 — 2/21
I. Facts and procedure
1. On April 25, 2022, the complainant filed a complaint with the Data Protection Authority
against the defendant, because his two professional email addresses
were still active with the defendant after he had left the company more than two years ago.
2. On July 5, 2023, the complaint was declared admissible by the First Line Service on the basis
of Articles 58 and 60 of the WOG and, pursuant to Article 62, § 1 of the WOG, the complaint was
transferred to the Dispute Resolution Chamber.
3. On February 8, 2024, the Dispute Resolution Chamber decided, pursuant to Article 95, § 1, 1° and Article 98
of the Dutch Civil Code (WOG), that the case was ready for consideration on the merits. That same day, the
parties involved were notified by registered mail of the provisions
mentioned in Article 95, § 2, as well as those in Article 98 of the
WOG. They were also notified, pursuant to
Article 99 of the WOG, of the deadlines for submitting their defenses.
The parties were asked to conclude on the following alleged
violations:
• Violation of Article 5.1.a) in conjunction with Article 6 GDPR due to a lack of
lawfulness and legal basis for processing for up to 2 years after the complainant's departure
from the company
• Violation of Article 5.1.b) GDPR due to the lack of purposefulness of the
processing after the complainant's departure from the company
• Violation of Article 5.1.c) GDPR due to failure to comply with
data minimization of processing after the complainant's departure from
the company
• Violation of Article 5.1.e) GDPR due to the failure to limit or respect the
retention period of the personal data after the complainant's departure
from the company
• Violation of Article 15 GDPR due to the failure to comply with the request for
access to the personal data in the complainant's two mailboxes
• Violation of Article 17.1 GDPR due to the failure to sufficiently comply with the complainant's
request for erasure
4. Following the hearing of 6 May 2025, the parties were requested on 8 May 2025 to provide additional
conclusions regarding the moment at which a specific technical
measure was activated by the respondent on the complainant's two email addresses. Decision on the merits 01/2026 — 3/21
II. Reasons
II.1. The Complaint
5. On 13 April 2019, the professional collaboration between the complainant and the respondent
ceased and the respondent took over the management of the complainant's mailboxes. Following
a private email dated 9 February 2021, the complainant discovered that his email address was still active with the
respondent. The respondent confirmed the continued existence of both of the complainant's email addresses, but stated that this choice was necessary for the
technical functioning of the email infrastructure and that sufficient technical measures
were taken to ensure that no infringements against the protection of the complainant's
personal data occurred.
6. The complainant stated that the continued existence of his two email addresses constituted a breach
of the protection of his personal data and stated that he had not been granted access to
these mailboxes, despite his repeated requests.
II.2. Procedural objections
7. The respondent argues in various grounds that the complaint is inadmissible. For example,
the right to good administration and the principle of due care were allegedly violated
given that the reasonable time for processing the file had been exceeded. The
late processing also allegedly irrevocably affected the rights of defense. Moreover, the Dispute Resolution Chamber allegedly failed to investigate in advance whether
there had been an abuse of rights, as the complainant's actual motives
were allegedly motivated by dissatisfaction with the price at which he had sold his shares
to the defendant and by the impossibility of transferring his old customer base
to his new company.
II.2.1. Admissibility of the complaint
8. Regarding the admissibility of the complaint, the Market Court stated in its judgment 2022/AR/42: "the
WOG stipulates that the Dispute Resolution Chamber, once a complaint has been filed with it,
cannot decide on the admissibility of complaints submitted to the GBA." (free
translation by the Litigation Chamber) and “A reading of [Articles 94, 95, and 100 of the
WOG] clearly shows that the legislature has not provided for the possibility of the
Litigation Chamber deciding on the admissibility of the complaint submitted to it.
2Appendix 8 to Exhibit 2, complaint form – violation of privacy by [defendant].
3Court of Appeal Brussels, Market Court Section, judgment 2022/AR/42 of 8 June 2022, paragraph 20: ) ‘[…] the LCA does not prevent
the Litigation Chamber, once a plain, from making a decision on the admissibility of the plaints
addressed to the APD.’ Decision on the merits 01/2026 — 4/21
4
.” (free translation by the Dispute Resolution Chamber) Given that the First Line Service
has ruled that the complaint is admissible, the Dispute Resolution Chamber cannot
reverse this decision and is obliged to handle this complaint.
II.2.2. Abuse of rights and the complainant's interest
9. Article 58 of the Dutch Data Protection Act (Wet Bescherming Persoonsgegevens) stipulates: "Anyone may submit a written, dated, and signed
complaint or request to the Data Protection Authority." The
Dispute Resolution Chamber rules that Article 58 of the Dutch Data Protection Act (Wet Bescherming Persoonsgegevens) offers any person the opportunity to
submit a complaint, provided the complainant demonstrates a sufficient interest.
In paragraph 29, the Dispute Resolution Chamber ruled that the defendant processes the complainant's personal data, which the complainant also demonstrates in his complaint using a personal email addressed to him at one of the two email addresses in question. The 5
Dispute Resolution Chamber ruled that the complainant demonstrates sufficient interest to file a complaint against the processing of his personal data under the responsibility of the defendant.
10. Regarding the defendant's alleged abuse of rights, the
Dispute Resolution Chamber finds that the collaboration between the complainant and the defendant was terminated on February 13, 2019. Two years after the termination of this collaboration and one year after the end of the contractual non-compete clause, the complainant learned that his email addresses on the defendant's domain were still active. The Litigation Chamber rules that
• given the time elapsed between the end of the collaboration and the complaint,
• given the direct cause of the complaint, specifically a private email that
had arrived at one of the two email addresses in question on the domain of
the defendant, and
• given the complainant's request to stop this processing and to
obtain access to his personal data,
the complainant did indeed intend to report a violation of his right to
data protection and that, therefore, there is no abuse of rights on the part of the complainant. For this assessment, the Litigation Chamber also refers
to the judgment in Datenschutzbehörde of the Court of Justice of the European Union
(hereinafter “CJEU”), which states: “However, it can be established that there is intentional
... 94, 95 et 100 de la LCA] que le législateur n'a pas prévu, pour la
Chambre contentieuse, la possibilité de prendre une decision quant à la recevabilité de la plainte dont elle a été saisie […]”.
5
Appendix to document 2, complaint form – violation of privacy by [respondent] of April 25, 2022, document 8.
6See Appendix to document 2, complaint form – violation of privacy by [respondent] of April 25, 2022, document 4. Decision on the merits 01/2026 — 5/21
abuse when a person files complaints without this being objectively necessary to
protect the rights they derive from this regulation.” 7
The Dispute Resolution Chamber takes into account that during the mediation between
the parties, the complainant claimed compensation for lost leads and for the damage caused
to his reputation by not answering the emails sent to him.
However, these business interests of the complainant do not alter the fact that
maintaining his email addresses also gave rise to grievances that affect his personal
rights under the GDPR. Reducing the complainant's right to complain
due to potential business interests would mean that the complainant would not be able to raise the violation of these
personal rights with the GBA and the Dispute Resolution Chamber in particular.
Moreover, the Dispute Resolution Chamber is not aware of any other proceedings
in the complainant's behalf concerning the violation of these business interests that could
demonstrate that this procedure has been affected by any abuse of law.
II.2.3. The principle of good administration
11. The The defendant believes his rights of defense have been violated because the complaint was not handled by the GBA within a reasonable time. The defendant
specifically states: “The facts of the complaint relate to Outlook email addresses of the [complainant]. The standard audit log retention policy in Microsoft 365
(M365) is twelve (12) months. This means that all logs from 2019 through
2021 relating to the email address [complainant's email] and [complainant's email] have been
irreversibly deleted […], as a result of which certain essential evidence
relating to the complaint has also been permanently deleted.”
12. The Litigation Chamber, however, finds that the defendant's argument for not providing access to the complainant's personal data is based on the fact that the complainant's emails do not reach the defendant's Microsoft environment thanks to the
9
/dev/null measure: "In the present case, [the defendant] had absolutely no access
to the incoming emails at [the complainant]'s email address after the email addresses were transferred. Moreover, the devnull action caused all incoming emails
to be immediately deleted from the Postfix mail queue and not forwarded to the
7
CJEU Judgment of 9 January 2025, Österreichische Datenschutzbehörde, C-416/23 ECLI:EU:C:2025:3, para. 50.
8 Document 21, Summary Conclusion of Defendant DOS-2022-01908 of May 2, 2024, marginal 44.
9
Regarding the /dev/null measure: ‘the null device is a device file that discards all data written to it but reports that the write operation succeeded’ from https://en.wikipedia.org/wiki/Null_device, consulted on April 25, 2025. Machine translation: ‘the
null device is a device file that discards all data written to it, but reports that the write operation
was successful’. See also marginals 22 et seq. of this decision. Decision on the merits 01/2026 — 6/21
[the defendant's] Office 365 environment. The incoming emails therefore never reached [the complainant]'s mailboxes."10
13. One of two things: either the emails do not arrive in the defendant's Microsoft environment and there are no logs that could have been used as evidence in
this case, or there are logs of the emails arriving in the defendant's Microsoft environment
that could have been used as evidence in this case, which would
mean that the defendant did have access to these emails.
11
14. The audit report added to the documents by the defendant clearly states:
"The investigation shows that the Office365 mail infrastructure that existed at the time of [the complainant]
was modified by [the defendant] during the acquisition. Instead of delivering incoming
emails directly to the Office365 server, they were delivered to a
Postfix mail system." 12 and concludes: “The ‘devnull’ mechanism was
implemented and the logs show that it worked effectively, and therefore no emails intended
for [the complainant] were forwarded to the Office 365 environment.” 13
15. The defendant also believes that he could not reasonably have expected the complainant
to file a complaint regarding the processing of his email addresses. The defendant
only learned of the complaint on February 8, 2024, while the facts date back to February 2019.
However, the Dispute Resolution Chamber notes that the alleged infringement only came to light on February 9, 2021
and that the complainant first contacted the defendant on
March 23, 2021. In this initial letter from the complainant, the complainant clearly stated: “In the absence
of receipt of the requested copy of the emails and of proof of the
actions requested above […] the client will immediately file a complaint with the
Data Protection Authority.” 14. Furthermore, the Dispute Resolution Chamber finds that the
defendant demonstrates the effectiveness of the /dev/null measure with email logs from
February through March 2021. These logs were requested from the IT department "after
receiving the first letter from [the complainant's] counsel." The defendant
was therefore informed of the dispute and a possible complaint to the GBA within
two months of establishing the alleged infringement; this demonstrates that the
defendant was already gathering evidence at that time.
16. The Dispute Resolution Chamber finds that the rights of the defense of the
defendant have not been violated, especially since the defendant submitted its arguments in writing.
10. Document 21, Summary Opinion of the defendant DOS-2022-01908 of May 2, 2024, paragraph 65.
11
See paragraph 22 of this decision.
1 Appendix D.7 to document 23, Defendant's summary statement of May 2, 2024, p. 3.
13
Ibid, p. 7.
14 Appendix to document 2, complaint form – violation of privacy by defendant NV of April 25, 2022, document 10.
15
Document 21, Defendant's summary statement DOS-2022-01908 of May 2, 2024, paragraph 30. Decision on the merits 01/2026 — 7/21
was able to file and defend himself orally during the
hearing.
II.3. Delimitation of the handling of the complaint: the scope of the complaint
16
17. The Dispute Resolution Chamber has already ruled in previous decisions that an employer
may, in principle, disclose the email addresses and Employees' email inboxes must be closed upon
the employee's departure. In its decisions on this matter, the Dispute Resolution Chamber has always
taken into account a reasonable period during which the email address can remain
in existence so that correspondents of the departed employee can be informed via an automated message
who to contact, since their contact person is no longer employed by the organization. This reasonable period is
standardly 1 month and can be extended to 3 months in certain circumstances.
18. The complainant stated in his complaint: "Through this channel, the [complainant] learned that this email address,
almost two years after he left his employment with [respondent], was still active." (emphasis by complainant) and "It is, of course, unacceptable that the [complainant's] email addresses
were still active after all this time."18 The complaint was apparently directed
against the continued existence of the email addresses for a longer period.
Moreover, the complainant also believed that the specific technical measure that was
applied to these mailboxes did not prevent his rights from being violated. According to the respondent, this
technical measure was implemented at the earliest 5 months after the complainant's departure.
19. Based on the complaint, the Dispute Resolution Chamber establishes that the processing intended by the complainant
takes place after a reasonable period of a maximum of 3 months, after which the email
address and mailbox should have been permanently deleted. However, after this period,
the complainant's mailboxes were migrated to the new IT environment of the
respondent. The infrastructure manager at the time stated that the migration of the
mailboxes on April 21, 2020: “the only file of interest is the change that
occurred on April 21, 2020. This was the change from Frontbridge (O365) to the
20
[defendant] (our own data relay center)” (free translation by the Dispute Resolution Chamber).
The same infrastructure manager states that for such a migration, the
16. Among others, Decision 64/2020 of September 29, 2020, Decision 138/2024 of November 19, 2024, Decision 134/2025 of August 21, 2025, …
17
Part 2, complaint form – violation of privacy by [defendant], April 25, 2022, point 4 under the heading ‘your complaint’.
18Ibid, point 5 under the heading "your complaint."
19
Although additional conclusions were reached after the hearing regarding the implementation of this technical measure, it was no longer possible to determine the exact date of implementation. However, the defendant states in its
supplemental conclusion that it was plausibly implemented on July 7, 2019: appendix 20250606 supplementary conclusion
[defendant] v1 to document 37, supplementary conclusion of June 6, 2025, marginal number 6.
20
Appendix D.11. Statement of [X] to Document 38, Supplemental Conclusion, Email of May 28, 2025, bullet 3: "only record of interest is
the change occurred on April 21, 2020. This was the change from Frontbridge (O365) to [defendant] (our data center relays)." Decision on the merits 01/2026 — 8/21
data to be transferred would be determined. This data would consist
of a list of usernames (linked to a mailbox and OneDrive), which would be obtained
from the local administrator. A third party would then transfer the actual data. 21 Based
on this statement, the Dispute Resolution Chamber finds that, despite the fact that the complainant
had already left the respondent for more than a year, his email addresses and associated
mailboxes were still retained for transfer to the respondent's new IT
environment.
20. This decision will assess the respondent's management of the complainant's email addresses and mailboxes
after this migration, which corresponds to the scope of
the complaint.
21. The Dispute Resolution Chamber notes that both the complainant and the defendant pay considerable attention
to the business acquisition of the complainant's company by the
defendant, the complainant's position in the various companies, and the
contractual agreements between the complainant and the defendant regarding a non-competition
clause and the takeover of the customer base. The Dispute Resolution Chamber does
not address any processing of personal data during this business
acquisition period, as this period was not included in the scope of the complaint by
the complainant.
II.4. Processing of personal data
22. In its conclusions, the defendant primarily points out the material lack of jurisdiction of the
GBA (Data Protection Authority) because it allegedly did not process the complainant's personal data. It had, after all, implemented a
technical measure (hereinafter '/dev/null measure') that ensured that it did not
have access to the content of the emails that still arrived in the
complainant's mailboxes. The defendant demonstrates this with a technical audit report 22 from two sworn
technical court experts (hereinafter "audit report"), which he adds to the documents.
With this audit report, the defendant attempts to demonstrate that the /dev/null measure he
had implemented on the complainant's mailboxes did indeed ensure that the defendant
did not have access to the content of the emails that arrived at the complainant's two email addresses.
23. Article 4.1 of the GDPR defines personal data as: "any information relating to an
identified or identifiable natural person ("data subject"); A natural person is considered
identifiable if he or she can be identified, directly or indirectly,
in particular by reference to an identifier such as a name, a
2 Ibid, bullet 2.
22 Appendix D.7, Court Experts' Audit Report on Document 23, Defendant's Document Bundle, Summary Opinion of 2 May 2024. Decision on the merits 01/2026 — 9/21
identification number, location data, an online identifier, or one or more
elements specific to the physical, physiological, genetic, mental,
economic, cultural, or social identity of that natural person.
24. The Litigation Chamber finds that the two email addresses referred to by the complainant
both contain his or her first name and surname as identifiers and are therefore in themselves
personal data. In this case, the email address links the complainant's name to the domain name of a company he had no longer belonged to since February 13, 2019.
The Dispute Resolution Chamber ruled that the continued existence of both email addresses
in itself constitutes processing of the personal data of an identified person.
25. All information about these two email addresses, both the metadata and the message in the emails themselves,
in this case, the entire mailboxes behind these email addresses, are therefore
also personal data within the meaning of the GDPR. The audit report states: “An email
consists of a header and a body. The header contains information about the sender, the
recipient, the time, etc. … The body of an email contains the message itself and any
attachments. […] Throughout this entire process, both the header and the body of the email remain intact.
[…]23
26. Based on the audit report, the Dispute Resolution Chamber concludes that the personal data
linked to the two email addresses is indeed processed: “When an email
is received by a relay server, both the header and the body of the email
are received in their entirety by the mail server. The relay server analyzes the header of the
email to determine where it should be sent. This analysis includes
checking the recipient(s), determining the destination mail server, and
performing any filtering or security checks based on the
header information.” […] Each email is therefore temporarily and completely stored in a queue.
24
(queue).” 27. The defendant argues that due to the /dev/null measure, the emails to the complainant's email addresses never reached the defendant's email environment,
since they were technically diverted to a virtual trash bin by the relay server.
The defendant therefore claims that he could never access the emails, from which he
infers that he did not process any personal data of the complainant.
28. However, the Dispute Resolution Chamber finds that after receiving the complainant's first letter,
the defendant requested the email logs of the email addresses in question from
23Document 21, Summary Opinion of the defendant DOS-2022-01908 of 2 May 2024, marginal number 28.
24Ibid. Decision on the merits 01/2026 — 10/21
25
its IT department. In an example of the email log, which the defendant had added to the documents, the sender of the email to the complainant is visible; in this case, this was a fuel card provider. Based on this example from the
defendant, the Dispute Resolution Chamber establishes that, through its IT department, it has access to the email logs of the
messages sent to the complainant's existing email address and
therefore had at least insight into who sent an email to one of the
complainant's two email addresses.
29. The Dispute Resolution Chamber finds that the defendant processes
identified personal data of the complainant via the complainant's two email addresses. The Dispute Resolution Chamber is
therefore competent to handle this complaint based on the material
scope of Article 2 of the GDPR.
II.5. The principle of lawfulness of Article 5.1.a in conjunction with Article 6.1 GDPR
30. In his fourth ground of appeal, the defendant addresses his obligations under the GDPR and states
that he has always acted in good faith and was not responsible for
closing the email addresses. He argues in four points that:
• he could not have been aware of decision 64/2020 of the Dispute Resolution Chamber of
29 September 2020, in which the Belgian Data Protection Authority (DPA) suddenly changed its view on closing
email addresses in a professional context compared to
the recommendation of the Commission for the Protection of
Privacy (the predecessor of the DPA, hereinafter ‘CPP’) of 2012
regarding the monitoring of electronic communication tools in the
workplace.6
• there are clear differences between the context of the complaint and the context of
decision 64/2020, given the implementation of the /dev/null measure on the complainant's email addresses.
• the complainant himself was responsible for closing his email addresses,
given that he himself was the data controller at the time of the sale
of the company.
• the respondent's current working methods since November 2020 are in accordance with
Decision 64/2020.
31. Regarding the 2012 recommendation of the CPP, the respondent is of the opinion that the
handling of the complainant's mailboxes was in accordance with this recommendation and
25 Document 23, Defendant's bundle of documents, summary conclusion of 2 May 2024, Annex D.2.
26 CPP, Recommendation No. 08/2012 concerning the employer's control of the use of electronic communication tools in the workplace (CO-AR-2010-002) of 2 May 2012. Decision on the merits 01/2026 — 11/21
resumes the following practical example to demonstrate this compliance: “It is not
always advisable to indicate in the automatic reply to the sender
that the employee is no longer part of the organization's staff;
such an indication will therefore only be possible with the explicit and formal
27
consent of the employee.” The Litigation Chamber notes that the recommendation
of 2012 contains three practical examples regarding the section on “dismissal of an employee,”
of which the defendant cites point 3. However, the Litigation Chamber notes that point 1
corresponds to the situation in this case: “In the event of departure with notice of termination,
28
a procedure must be provided […] in consultation with the employee at the time of his departure.”
As the defendant himself stated, the complainant's departure did not come as a
surprise, and there was time and opportunity to consult with the complainant, not least
because a contract was being negotiated between the complainant and the defendant regarding
the sale of the company and the acquisition of the customer base. The
Dispute Resolution Chamber finds that this argument by the defendant is not sufficient to demonstrate the
lawfulness of the processing of the complainant's personal data.
32. The Dispute Resolution Chamber finds that decision 64/2020 concerning the closure of an employee's
inbox was indeed taken after the complainant left the
respondent and within a reasonable period as determined above. The fact that this decision
did not yet exist at the time of the complainant's departure from the respondent does not release the
respondent from the responsibility to guarantee and demonstrate the compliance of its processing with
the GDPR (in accordance with Articles 5.2 and 24.1 GDPR). Moreover,
this decision was taken on 29 September 2020. The complaint shows that the
respondent had still not adjusted the processing of the complainant's email addresses in accordance
with the GDPR in February 2021. Indeed, it was demonstrated above that the
/dev/null measure only prevents part of the processing, namely the
forwarding of the email to the defendant's email environment. This measure
does not prevent the still-existing email addresses from continuing to link the complainant to a
company he had already left in 2019 and that the future emails were indeed
processed. Although the content of the emails was deleted at very short notice,
the logs of these emails remained available for retrieval from the defendant.
33. Regarding the current procedure that has been in place since November 2020, the
Dispute Resolution Chamber finds that this clearly does not apply to the complainant's email addresses,
since they still existed and were accessible
at the time of the complaint in February 2021. Regarding the complainant's responsibility to manage his own email addresses,
27
Ibid, p. 52.
28Ibid.
29
See paragraphs 17 et seq. of this decision.
30See paragraphs 24-29 of this decision. Decision on the merits 01/2026 — 12/21
31
the Disputes Chamber has already ruled earlier in this decision that the
correct handling of the complainant's email addresses upon his departure does not fall within the
scope of this complaint and will therefore not be addressed. The fact is that the respondent, at
the time of the mailbox migration, decided to migrate the complainant's mailboxes to its new email environment,
even though the complainant had left the company
more than a year earlier.
34. Article 6 of the GDPR stipulates that all processing must have a legal basis.
This means that the controller may not
process personal data without relying on one of the lawfulness criteria listed in Article 6.1 of the GDPR,
which embody the principle of lawfulness as
referred to in Article 5.1a of the GDPR.
35. The Dispute Resolution Chamber finds that the respondent relies on the legitimate interest of Article 6.1.f of the GDPR: “[respondent] had a legitimate interest (Article 6.1.f
GDPR) in opting for the devnull action for [the complainant]'s email addresses to avoid
sending emails back and forth, which would have polluted [respondent]'s servers.
It is also common practice to ensure that emails
32
from inactive users no longer arrive and are automatically deleted.”
36. The Dispute Resolution Chamber finds that an employee's mailbox, in view of the
legitimate interest of the controller, in accordance with the
conditions of Article 6.1. f GDPR, for a certain period after the complainant's departure,
the processing of the data may continue to be active, insofar as this is limited to the automatic sending of
standard communications regarding the departure of an employee, with a view to
ensuring the proper functioning of the company and the continuity of its
services. This is, of course, only possible provided that the other provisions of the GDPR are also
respected, in particular Article 13.1 c) GDPR, which stipulates that before
processing activities commence, the applicable
legal basis and the specific purpose must be determined, with the
obligation for the controller to inform the data subject thereof.
37. The Dispute Resolution Chamber finds that, after a reasonable period, the respondent continues to
process the email addresses for a new legitimate interest, namely preventing the
pollution of the respondent's servers, provided the /dev/null measure is implemented.
31See paragraph 21 of this decision.
32 Document 21, Summary Opinion of the defendant DOS-2022-01908 of 2 May 2024, paragraph 67. Decision on the merits 01/2026 — 13/21
33
38. In accordance with the case law of the CJEU, in the case of
legitimate interest, the defendant must demonstrate that:
a. The interests it pursues with the processing can be
recognized as legitimate (the "purpose test");
b. The intended processing is necessary for the realization of those interests
(the "necessity test");
c. The balancing of those interests against the interests, fundamental
freedoms and rights of the complainant weighs in favor of the
defendant or a third party (the "balancing test").
39. First, the Dispute Resolution Chamber notes that the defendant in no way
demonstrates that it has made this balancing test, which is nevertheless a requirement under
the accountability principle of Article 5.2 of the GDPR. The Dispute Resolution Chamber will itself proceed to
weigh the defendant's interests against those of the complainant in order
to assess whether the defendant could rely on this legitimate interest
to continue processing the complainant's email addresses after the reasonable period.
Purpose test:
40. Regarding the interest pursued by the defendant through the processing, the CJEU has already
ruled that "Firstly, as regards the requirement of pursuing a
“legitimate interest,” in the absence of a definition of this concept in the
GDPR, it should be noted […] that a wide range of interests can, in principle, be considered
legitimate." Since preventing the contamination of
a company's servers is a legitimate goal that all companies pursue,
the Litigation Chamber rules that the defendant's interest in this processing
is justified.
Necessity test:
41. Regarding the necessity of the processing by the defendant, the processing is only
justified if the interest pursued cannot be achieved in another
way that is less detrimental to the fundamental rights and freedoms of the complainant than
the current solution. This condition must also be tested against the principle of
minimum data processing in Article 5.1.c GDPR, which states that the processing
35
is adequate, relevant, and limited to what is necessary.
33
ECJ, Judgment of 4 May 2017, Rīgas Satiksme, C-13/16, ECLI:EU:C:2017:336, para. 28, and CJEU Judgment of 7 December 2023,
Joined Cases C-26/22 and C-64/22, Schufa, ECLI:EU:C:2023:958, para. 74.
34
CJEU Judgment of 7 December 2023, Joined Cases C-26/22 and C-64/22, Schufa, ECLI:EU:C:2023:958, para. 76.
35CJEU Judgment of 7 December 2023, Joined Cases C-26/22 and C-64/22, Schufa, ECLI:EU:C:2023:958, paras. 77 and 78. Decision on the merits 01/2026 — 14/21
42. The defendant claimed that maintaining the email addresses in combination with
the /dev/null measure was a common practice to keep the defendant's servers
"healthy." The rationale is that the emails themselves will no longer arrive
in the defendant's email environment and will be automatically deleted. Only in this
way could the defendant prevent "servers from sending error messages back and forth."
43. The problem of "continuing to send error messages back and forth" only occurs when
the sender of the email sends an email to the complainant that replies to the complainant's closed-
address with a "user unknown" message. If the
sender of the email also replies with "userunknown," a ping-pong
of "userunknown" messages would occur. However, this situation is highly unlikely, given
The sender of the email to the complainant's email address is a 'known user'. Furthermore, the state of the art allows this possible back-and-forth sending of error messages to be avoided through other means, whereby the complainant's email addresses can be completely
closed and thus no longer require the processing of the complainant's personal data. The Dispute Resolution Chamber rules that the processing of the complainant's personal data, as organized by the respondent, is not
necessary, as there are equally efficient alternatives to protect the respondent's servers from contamination without having to maintain the complainant's email addresses.
Conclusion:
44. Since the three conditions for demonstrating a legitimate interest
are cumulative and since the processing of the personal data is not necessary,
the Dispute Resolution Chamber finds that the defendant cannot rely on the
legitimate interest of Article 6.1.f GDPR and that the processing of the
complainant's personal data is therefore not lawful under Article 5.1.a GDPR. The
defendant's argument does not address the core of this issue.
45. The Dispute Resolution Chamber finds a violation of Articles 5.1.a GDPR in conjunction with 6.1 GDPR
since the defendant has no legitimate interest in processing the complainant's personal
data after the mailbox migration and cannot demonstrate any other
grounds for processing the complainant's personal data. 36 Document 21, Summary Opinion of the Defendant DOS-2022-01908 of 2 May 2024, paragraph 10. Decision on the merits 01/2026 — 15/21
II.6. The principles of purpose limitation (Article 5.1.b GDPR), data minimization (Article
5.1.c GDPR), and storage limitation (Article 5.1.e GDPR)
46. Given that the processing of the complainant's personal data was not lawful and
consequently should not have taken place, as well as the fact that the principle of data minimization
is taken into account in the justification test under Article
6.1.f GDPR, the Litigation Chamber will no longer address the assessment of the other
principles cited in the invitation to submit conclusions.
II.7. The complainant's right of access (Article 15 GDPR)
47. Article 15 GDPR gives the complainant the right to confirm whether their data
are being processed and, if so, to access this data.
48. The respondent argues that he could not grant access because the /dev/null measure diverted incoming emails to a virtual trash bin. For the same
reason, he could also not provide a copy of the complainant's personal data.
49. However, the Dispute Resolution Chamber ruled above that the respondent was still processing the complainant's personal data after the migration of the
mailboxes. Although the /dev/null-
measure deleted the emails themselves within a very short time, the
respondent demonstrated that it could retrieve the sender of these emails from the logs
of the environment where the emails initially arrived. Given that this data
concerned the complainant's personal data, the complainant was entitled to
receive this personal data. This would have allowed the complainant to check whether any emails had arrived from personal contacts that it might have missed, such as the
email that was the basis for the complaint.
50. The Dispute Resolution Chamber finds that the respondent infringed Article 15 of the GDPR by
not providing access to the complainant's personal data that was still being processed after
the mailbox migration, specifically the logs kept of the emails that
still arrived at the complainant's two email addresses.
II.8. The right to erasure (Article 17 GDPR)
51. Article 17.1 GDPR gives the complainant the right to request and obtain the erasure of all their data
when (d) the personal data has been processed unlawfully.
52. The respondent argued that the /dev/null measure deleted the complainant's personal data
immediately upon receipt.
37 See paragraph 29 of this decision. Decision on the merits 01/2026 — 16/21
53. Above, 38, the Dispute Resolution Chamber ruled that the complainant's personal data
were processed unlawfully after the mailboxes were migrated. In addition to the continued existence
of both email addresses themselves, the Dispute Resolution Chamber found that the logs
of the incoming emails were indeed accessible to the respondent. This was
demonstrated by the defendant himself, as he had requested a sample of such a log via the IT department and added it to the conclusion.
54. Since these personal data were processed unlawfully, the complainant had the
right to obtain this deletion, and the defendant should have deleted both the email addresses themselves and all
logs linked to these email addresses within thirty
days of the complainant's request.
55. The Dispute Resolution Chamber finds that the defendant infringed Article 17.1 of the GDPR by
failing to delete all of the complainant's personal data despite his request to do so.
III. Corrective measures and sanctions
III.1. Corrective measures and sanctions
56. According to Article 100 of the Dutch Data Protection Act (WOG), the Dispute Resolution Chamber has the authority to:
1° dismiss the complaint;
2° order that the prosecution be dismissed;
3° to order a suspension of the judgment;
4° to propose a settlement;
5° to issue warnings and reprimands;
6° to order that the data subject's requests to exercise their
rights be met;
7° to order that the data subject be informed of the
security problem;
8° to order that the processing be temporarily or definitively frozen, restricted, or
prohibited;
9° to order that the processing be brought into compliance;
10° to order the rectification, restriction, or erasure of data and
the notification thereof to the recipients of the data;
11° to order the withdrawal of the recognition of certification bodies;
38See paragraph 45 of this decision. Decision on the merits 01/2026 — 17/21
12° to impose penalty payments;
13° to impose administrative fines;
14° to order the suspension of cross-border data flows to another
State or an international institution;
15° to transfer the file to the Public Prosecutor's Office of
Brussels, which will inform it of the action taken on the file;
16° to decide, on a case-by-case basis, to publish its decisions on the
website of the Data Protection Authority.
III.2. Seriousness of the infringement
57. The Litigation Chamber ruled that the defendant had no legal basis under
Article 5.1.a GDPR in conjunction with Article 6.1 GDPR to process the complainant's email addresses and associated
personal data after the defendant had migrated the mailboxes. Regarding the nature of the infringement, the Litigation Chamber takes into account that
the principle of lawfulness is a fundamental principle of the protection guaranteed
by the GDPR. It is also included in Article 8.2 of the
Charter of Fundamental Rights of the European Union. The Litigation Chamber ruled that
infringements of this core principle therefore constitute serious infringements.
58. The Litigation Chamber also ruled that the defendant had not provided access to
the complainant's personal data it was still processing, despite the complainant's repeated
requests. The right of access constitutes the gateway and therefore also the cornerstone
for exercising other rights provided for by the GDPR, such as the right to
object to the processing of personal data (Article 21 GDPR) and the
so-called right to be forgotten (Article 17 GDPR). It is therefore of paramount importance that
data subjects exercising their right of access actually obtain access to all
personal data concerning them and collected by the controller.
59. Finally, the Litigation Chamber also ruled that the defendant refused to
erase the complainant's personal data despite the complainant's repeated requests. Since
these personal data were processed unlawfully, they should not have been in the defendant's possession,
and only immediate erasure of these data could adequately rectify this
unlawfulness.
60. However, the Litigation Chamber also takes into account that the defendant attempted to limit the processing of these personal data with the /dev/null-
measure. Although this
technical measure did not prevent the processing of the personal data, as
claimed by the defendant, the measure ensured that the email messages themselves did not arrive in the defendant's Microsoft environment and were therefore not readable
by the defendant's staff.
61. Finally, the Litigation Chamber is sensitive to the fact that the defendant works in the
ICT sector and specializes in cybersecurity. The defendant is therefore deemed
to be aware of the modalities and consequences of the technical measure it implemented
and of the state of the art regarding alternative measures to prevent this processing
of personal data.
62. The Litigation Chamber finds that, taking into account the judgment in Deutsche Wohnen
39
of the CJEU:
• the defendant could not have been unaware that his actions constituted an infringement;
• there is no evidence of intent;
• there is only limited negligence, given the measures taken;
and finds that, given the passage of time, an administrative fine would not be the
most useful measure in this case.
III.3. Corrective measures and sanctions
III.3.1. Corrective measures
63. Now that the Litigation Chamber has determined that the respondent had no legal basis to process the complainant's
personal data, had not granted the complainant access to
the processed personal data, and had refused to erase the complainant's personal data
despite the complainant's repeated requests, it is appropriate
to take corrective measures against the respondent.
64. In the context of effective legal protection under Article 47 of the Charter of
the European Union and the effective enforcement that the legislator aims for with the GDPR,
it is first and foremost appropriate to order the defendant, in accordance with Article 58.2.f of the GDPR and Article 100.8°
of the Data Protection Act, to cease processing the email addresses and associated mailboxes of the
complainant, to provide access to all personal data of the complainant that are still
available to the defendant, and subsequently to delete all personal data of the complainant
relating to these email addresses. With this
order, the Litigation Chamber prevents the continued unlawful processing of the personal data of
the complainant, grants the complainant access to his personal data where possible, and complies
39 CJEU, Judgment of 5 December 2023, Deutsche Wohnen SE, C-807/21, ECLI:EU:C:2023:950, paras. 76-78. Decision on the merits 01/2026 — 19/21
with the complainant's request to finally erase all his personal data and
to delete unlawfully obtained personal data.
III.3.2. Sanctions
65. In these circumstances, and due to the established violations of Article 5.1.a of the GDPR
in conjunction with Article 6.1 of the GDPR, Article 15 of the GDPR, and Article 17.1 of the GDPR, the Dispute Resolution Chamber decides to
issue a reprimand pursuant to Article 58.2.b of the GDPR and Article 100.5° of the Dutch Data Protection Act (WOG)
with respect to the respondent, since:
• he processed the complainant's personal data without a
legal basis for doing so;
• he failed to grant the complainant access to these personal data, despite
repeated requests from the complainant; and
• he refused to erase the complainant's personal data after his repeated
requests, even though these personal data were processed unlawfully. Decision on the merits 01/2026 — 21/21
A motion for an inter partes decision must be filed with the registry of the Market Court
41
in accordance with Article 1034quinquies of the Judicial Code, or via the e-Deposit
information system of the Ministry of Justice (Article 32ter of the Judicial Code).
(Government). Hielke H IJMANS
Director of the Litigation Chamber
6° the signature of the petitioner or their attorney.
41 The petition and its appendices, in as many copies as there are parties involved, shall be sent by registered mail
to the clerk of the court or deposited at the registry.
