- The data protection authority imposed a fine of EUR 40,000 because an automatic e‑mail forwarding system had been set up unlawfully during sick leave.
- Violations concern Norwegian law and GDPR, in particular lack of legal basis and inadequate information to the data subject.
The Norwegian Data Protection Authority has fined a company EUR 40,000 for unlawfully setting up automatic forwarding of an employee’s e‑mails (cf. Media release). The employee had complained about this to the supervisory authority.
The forwarding was set up in connection with an absence of the employee due to illness and was active for more than one month. The data protection authority came to the conclusion that the forwarding violated provisions of Norwegian law on the employer’s access to e‑mail inboxes and the GDPR, the latter with regard to the legal basis and information of the data subject, among other things. However, as far as can be seen, no fundamental inadmissibility of the e‑mail forwarding was established.
Carlo Piltz has written a short comment on this decision (LinkedIn, in English).