Processing of employee data after termination of employment

The employer must at first assess which of the employee's data it still has a legal basis to process. For example, if the employee had a work email which, if deactivated immediately, could result in a loss of communication with the company's customers, or if the email contains information of importance to the company's business, it may continue to be used for reasonable time. If personal information, such as private correspondence between the former employee and other colleagues, is stored in the former employee's email, on a work computer or on any other device, the employer cannot use it for other purposes. In the context of the workplace, employees are entitled to the protection of their privacy and the confidentiality of their personal communications, even in instances where the data in question is stored on a device owned by the employer. 

To illustrate, a Norwegian company was subject to a penalty for the improper handling of an email account belonging to a former employee. After the employment relationship ended, the employer changed the employee's email password and continued to use the email for more than five months after the end of the employment relationship. The employer ignored the employee's request to delete his email. The national data protection authority found several violations of the GDPR in this case related to the unjustified use of the former employee's email, which resulted in the company having to pay a fine of  Euro 14,700.

In order to avoid potential breaches pertaining to the processing of employee’s data following the conclusion of the employment relationship, employer must ask employee to separate their personal data upon the termination of their employment. If employer becomes aware that it still possesses former employee’s personal data, it is then the responsibility of the employer to separate and, if necessary, delete the data, if there is no longer a lawful basis for its processing. It is crucial to notify the former employee on the ongoing utilization of their data. This may be exemplified in the context of email, where the former employee is informed that their email will continue to be used for a reasonable period. In this case the justification for this need and its expected duration must be clearly stated.

In any case, it is important for employers to remember that even though the employment relationship has ended, the former employee still has the right to access his or her own data which is processed or access any information regarding it and the employer cannot refuse to do so. Otherwise, the former employee has grounds to submit a complaint to the national data protection authority.

In the case of information that is publicly available and which represents the former employee's association with the employer, it is necessary to assess the need to retain this personal data. To illustrate, if the employer's website contains the contact details of a former employee or information indicating that the individual is still employed by the company, this information should be removed. Furthermore, it is possible that the employer's public website may contain publications in which the former employee is mentioned. In such a situation, the employee may request the deletion of their data; however, the employer may refuse to do so in certain cases. Such a refusal must be justified on the basis of the legitimate interests of the company, as well as an assessment of whether the interests of the employee outweigh the legitimate interests of the company in the particular case. The employer may refuse to delete such publications if it intends to delete most of the publications that are important to the employer, or if the information about the employee contained in the publication is an important part of the publication. In such a case, the evaluation of whether the publication should be deleted must consider whether the data subject, in this instance the former employee, could have foreseen that their data could still be utilised in this manner following the conclusion of their employment contract. 

It is imperative that any publication containing personal data is discussed with the employee in question. Furthermore, when preparing such publications, it is of the essence that the information included is carefully considered and that an assessment is made as to the necessity of including said information.​​​​