DP014Personal material in company accounts

The handling of a worker’s personal material held on systems the employer controls, during employment and after it.

Pillar: DP | Data and asset protection
Sources cited: 7
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
DP014/FIMandatory	Finland	Laki yksityisyyden suojasta työelämässä (759/2004)Parliament of Finland · read 29 Aug 2026	One act for the whole subject, holding processing to what is directly necessary, naming the conditions for cameras and for opening the employer’s electronic mail, and putting technical monitoring through a cooperation procedure before it is introduced.	What the employer may reach is the message belonging to it, identified from the sender, the recipient, or the title, and what is opened may not be processed further than the purpose requires nor disclosed during the employment or after it.
DP014/HUMandatory	Hungary	NAIH/2019/51/11, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That storing a former employee’s private correspondence in archived mailboxes breached storage limitation, that searching those archives for documents without proper information and without a basis breached fairness and purpose limitation, that the absence of technical and organizational measures and of information on the use and archiving of employees’ mailboxes breached accountability, and that the fine was 500,000 HUF.	The internal policy on the company e-mail account and laptop states whether private use is allowed, the rules on backup and deletion, and the rules of checking; where private use of a laptop is allowed the private data sit on a separate partition outside the backup and the check; where it is not allowed, the employer may record that private data were stored and not what they were. Keeping a former employee’s private correspondence in archived mailboxes breaches storage limitation, and the employer identifies and deletes it with the person’s involvement, letting the person copy the purely private data first.
DP014/ITMandatory	Italy	Provvedimento n. 165, ITAS MutuaGarante per la protezione dei dati personali · read 16 Aug 2026	That mailbox backups and browsing logs are instruments from which remote monitoring may follow, that an answer given in stages and handed over in part without saying what was withheld does not discharge the right of access, and that a five year backup of employee mail has to be disclosed to the people whose mail it holds.	A former worker retains a claim on personal material left in the account, and the employer has to be able to answer a request for access to it.
DP014/NOMandatory	Norway	Forskrift om arbeidsgivers innsyn i e-postkasse og annet elektronisk lagret materialeArbeids- og inkluderingsdepartementet · read 29 Aug 2026	When an employer may look into a work mailbox or a worker’s personal areas on its equipment, that monitoring of internet use is outside what it may do at all, and that the regulation cannot be contracted around.	The worker’s personal areas on the undertaking’s network and equipment are reached on the same conditions as the mailbox, and so is what was deleted from them and survives on a backup.
Recommended	Austriawhere written	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the Data Protection Officer either way.	There is no right for a worker to use the employer’s resources privately. Minor private or half private use within ordinary human social behavior should nonetheless be allowed or ignored, and a total prohibition pronounced only in extreme cases.
Recommended	Swedenwhere written	Kontroll och övervakning av anställdaIntegritetsskyddsmyndigheten · read 5 Oct 2026	That the bases for monitoring employees are the balancing of interests or, for public authorities, public interest, that consent is not one of them, that security reasons weigh more than efficiency reasons in the balancing, that employees are told in advance which controls may be made, that data collected for one purpose are not used for an incompatible other, and that the employer normally has no right to the content of an employee’s private files or emails.	The employer normally has no right to the content of an employee’s private files or emails.