€460K GDPR Fine for Unlawful Retrospective Employee Email Monitoring
The company violated core GDPR principles by conducting a sweeping, retrospective review of employee emails spanning two years prior to any formal suspicion arising — far exceeding what is proportionate or lawful. This breach of purpose limitation, data minimisation, and storage limitation principles demonstrates that even internal HR investigations must operate within strict legal boundaries. Employees retain a reasonable expectation of privacy even in the workplace, meaning monitoring must be transparent, targeted, and governed by clear policies. This case matters because it shows that misusing access to legitimately held data — not just collecting it unlawfully — can trigger significant regulatory penalties.
Tactical Insight
Immediate actions
- Establish a documented, legally reviewed policy governing when and how employee communications may be accessed during investigations.
- Ensure any ongoing or planned internal investigations are reviewed by legal counsel for GDPR compliance before accessing personal data.
Long-term improvements
- Implement strict data retention schedules for employee communications, ensuring emails beyond a defined retention window are automatically purged.
- Define clear purpose-limitation controls so that email archives can only be accessed for pre-approved, documented purposes with proportionality assessments.
- Provide regular GDPR training to HR, legal, and management teams on lawful bases for processing employee data.
Detection & governance measures
- Require a Data Protection Impact Assessment (DPIA) before initiating any retrospective access to employee communications or monitoring programmes.
- Maintain audit logs of all administrative access to email archives, with alerts for bulk or anomalous access patterns reviewed by the DPO.