How long should access to a former employee's mailbox be maintained?

ANSWER

The employee's email mailbox should be deactivated within a fairly short time after the end of the employment relationship. During this transitional period, an autoresponder should be set up informing about the end of the employment and indicating who clients should contact (a generic mailbox or a named contact). Automatic forwarding during this period requires particular justification.

An important issue is to establish and communicate the rules of procedure in advance.

Regarding access to the mailbox after the end of employment, reference may be made to the Council of Europe Recommendations on the protection of personal data used for employment purposes, which address this issue: 'When an employee leaves the organisation, the employer should take the necessary organisational and technical measures to automatically deactivate the Employee's account used for electronic communication. If employers need to recover the employee's account in order to run the organisation effectively, they should do so before their departure and, where feasible, in their presence'.

The employee should be aware of the rules on mailbox access before leaving employment.