Do not let anyone read a former employee's mailbox. Italy fined the recruiter Michael Page 225,000 euros.

An account manager in Milan hands in her notice. On her last day, IT follows Microsoft's guide to removing a former employee: block her login, then forward her email to a colleague or turn her mailbox into a shared one, so no customer email gets lost. Sending a leaver's new mail to someone inside the company is one of the things Italy's data protection regulator, the Garante, fined the recruiter Michael Page 225,000 euros for 1. The setup the Garante accepts is a leaver's mailbox kept open only for a limited time and only if the business needs it, with an automatic reply that tells senders who to write to instead, and with nobody at the company reading it. Denmark's regulator allows more, so the Italian setup is the safer default for a company with staff in several EU countries.

What did Michael Page do with the three mailboxes?

Three people left the company's Italian business in 2021 and went to work for a competitor 1. On the day each one left, the company blocked their login, but it kept the accounts. According to the decision 1:

• The accounts stayed until 25 September 2023. That is more than two and a half years for two of them and just under two years for the third.
• New mail kept arriving, and the company sent it to their old managers. The company said so in its own account to the regulator.
• The company searched nine months of their old email for messages to or from their private addresses or the new employer's domain, looking for leaks of confidential information. A forensic consultant copied what it found, and the company used it in court proceedings against the new employer and one of the three.
• There was no automatic reply. The company said one would have warned the former employees that their mailboxes were inactive and let them hide what they had done.

The decision is dated 6 August 2026. As Il Fatto Quotidiano's report on the fine notes, the company can still challenge it in court 1.

Why did the Garante fine Michael Page?

The Garante found three things wrong 1 2:

1. It kept the mailboxes too long, for the wrong reason. The GDPR only lets a company keep the personal data it needs, for as long as it needs it. Michael Page kept the accounts so it could go through them, and the Garante said that was no business continuity reason at all.
2. Reading the mail was unlawful monitoring of employees. Italian labour law strictly limits how an employer may check on its staff with technology, and the GDPR lets each country add rules like this for employee data (Article 88). The company had no legal basis for the reading, and the Garante rejected its claim of a legitimate interest. It also rejected the search of mail from before any suspicion of wrongdoing existed.
3. Staff were never told. The staff privacy notice said nothing about what happens to a leaver's email.

The Garante also rejected a rule in the company's IT policy that made staff hand their password to their manager on request. A manager's access to an individual mailbox "is not a lawful activity", and whoever checks a personal mailbox "cannot be the superior or, more generally, the employer" 1.

What does the Garante allow instead?

Where the business needs continuity, the Garante lets a company keep a leaver's individual mailbox "for a limited period of time, in any case proportionate to the stated purpose" 1. It sets three conditions 1:

• Nobody at the company reads it. The account stays open only so that mail to the old address does not bounce.
• An automatic reply points elsewhere. It tells senders which other addresses at the company to use.
• The period has an end. The Garante gives no number, but about two years was far over it.

Keeping a mailbox because of a lawsuit is a different case. The Garante's objection was that when Michael Page decided to keep the mailboxes, no lawsuit was under way or clearly coming, and nothing stopped the company reading them 1.

Do other EU countries allow more?

Denmark is one example. Its regulator, Datatilsynet, says a former employee's mailbox may stay open for "as short a period as possible", and "as a starting point" no more than 12 months, with an automatic reply, receiving mail only, and one or a few trusted employees with access 3. In its worked example, a company kept a leaver's mailbox open for up to a year because customers replied to its quotes by email, and one trusted employee read it. Datatilsynet calls that lawful "as a starting point" 3. (Quotes from the Italian and Danish sources in this post are my translations.)

On new mail, the two regulators read the same GDPR principles differently. On old mail from the time the person worked there, Italian labour law adds its own strict limits. Following the stricter rule everywhere is simpler than running a separate offboarding process per country.

What should you do when someone leaves your company?

If you employ people in the EU, set this up before the next person leaves. In my view, a leaver's mailbox has one job: tell senders where to write now.

• Write the rule into your staff privacy notice, including when the mailbox is deleted.
• On the last day, block the login and set an auto-reply naming a shared team address.
• Give nobody access: no forwarding, no Gmail delegation, and no members on a Microsoft 365 shared mailbox.
• Delete it after one to three months, my default. Ulf covered how to enforce a retention period.
• Preserve it for a lawsuit only on a lawyer's advice, with nobody reading it.
• Even with good reason to suspect a leak, never search mail from before the suspicion arose.
• Stop collecting passwords. Take the leaver's address off your website.