Italian regulator on former employees’ data access and email

Diritto Bancario, in its article “GDPR: accesso degli ex dipendenti ai propri dati e gestione email”, reports that Italy’s data protection authority found violations in the handling of a personal data access request and former employees’ email accounts, in decision No. 796 of 20 October 2026. The investigation began with a former employee’s complaint; the company responded only after nine months and after the authority intervened. Email concerns emerged during the investigation and were examined on the authority’s own initiative, despite the company’s objection that there had been no specific complaint. The full text of the decision has not been directly verified.

According to the publication, the company explained the delay by saying it had not recognised the request within a broader communication and citing difficulties retrieving documents following a corporate transfer. The authority rejected the first explanation because the former employee had expressly invoked data protection law and the right of access. It also recalled that exercising the right requires no particular formalities or necessarily an explicit reference to the GDPR. The second explanation was also considered insufficient: Article 12(3) requires a response within one month, extendable by a further two months depending on the complexity and number of requests, with the individual informed of the extension and its reasons. The authority found infringements of that provision and Article 15.

On email, Diritto Bancario attributes to the authority findings of non-compliance with the principles of lawfulness, data minimisation and storage limitation, and infringements of Articles 5(1)(a) and 88 GDPR and Article 114 of the Italian Privacy Code. Internal company rules provided for keeping former employees’ accounts active for several months, enabling the company to consult them. Under the reported reasoning, business continuity does not justify such access and retention for organisational purposes: relevant work documents must be archived through document management systems. When employment ends, the employer must deactivate and subsequently remove the account, establish automatic messages informing senders and providing alternative contact details where appropriate, and prevent itself from viewing incoming messages.