Suspension of mailbox access during career break

In a recent decision dated 8 April 2025, the Litigation Chamber of the Data Protection Authority (DPA) ruled on a complaint filed by an employee whose access to his mailbox had been suspended by the employer during the employee’s career break. Although the complaint was dismissed for reasons of expediency, some important lessons can still be drawn from this decision.

Facts

The DPA’s decision relates to a dispute between an employee and his employer. The employee’s access to his professional mailbox was suspended because he had taken a career break.

The employee accused the employer of (i) the absence of prior information before the suspension of  access to the professional mailbox; (ii) the inability to set up an automatic out-of-office message; (iii) the absence of communication or provision in the work regulations; (iv) the absence of specific regulations; and (v) not responding to his request for access. The employee then filed a complaint with the DPA.

Employer's defence

The employer defended the measure to suspend access to the mailbox based on the following arguments:

• The measure was applied in a non-discriminatory manner to agents who take a career break;
• The measure was included in a draft of the work regulations;
• The measure aimed to protect personal data, specifically to prevent unauthorised processing.

According to the employer, no request for access was made.

The employer further emphasised that: (i) the professional rights of agents regarding promotion, mandate allocation, and salary scales were safeguarded, and the relevant information was communicated via registered mail; (ii) the employee always had the possibility to contact the HR department through alternative channels (e.g., private e-mail, mail, and telephone); (iii) the employee also had the opportunity to set up an automatic out-of-office reply or print any necessary emails prior to the start of the career break; and (iv) the company was in the process of clarifying the policy on access suspension in the work regulations at the time of the events.

Assessment by the DPA

The DPA decided to dismiss the complaint for reasons of expediency. The DPA judged that the complaint was insufficiently detailed and lacked enough evidence to enable the DPA to take a decision . Additionally, the DPA considered that the complaint had no significant social or personal impact.

Regarding the lack of an automatic out-of-office reply, the DPA concluded that the employee could have set this up himself before the start of his career break. The employee had requested the career break himself and was therefore aware of its  start date.

Regarding the request for access, the DPA concluded that there was insufficient evidence to establish a violation of the GDPR. The employer had, on its own initiative, proposed to meet with the employee so that the employee could list the emails he needed, which the employer would then provide. However, the employee did not respond to this proposal or explain why it was insufficient to facilitate his right of access.

The DPA also took into account that:

• The employer had already taken measures, which rendered the subject of the complaint moot. At the time of the events, the employer was in the process of clarifying its policy on access to the professional mailbox in the work regulations;
• The employer had already explained why it could not grant access during the career break period, and its reasoning was justified within the framework of the GDPR. The employee never disputed or raised concerns about this reasoning.

Key message

The decision illustrates the importance of establishing clear agreements regarding the management of and access to professional mailboxes during (extended) absences (amongst others). The DPA acknowledges that these agreements can be included in the work regulations, although in our opinion a reference in a l company IT policy would suffice.

For questions about managing professional mailboxes or questions about data protection in general, the Claeys & Engels Data Protection team is always ready to help.