The Belgian Data Protection Authority ("DPA") has already had several occasions to comment on this issue - most recently, in a decision of 21 September 2023 (decision 135/2023). The DPA’s position in this matter is - in general - as follows:
- Retention of the professional mailbox is justified if - no later than the day of the employee's departure - the professional mailbox is provided with an automatic message.
- The purpose of the automatic message should be alerting correspondents about the employee's departure and designating a new person of contact.
- The automatic message can only be linked to this professional mailbox for a "reasonable period" (1 month - with depending on the context and subject to the ex-employee's consent, the possibility of extending this period to 3 months).
- The continued use - not just retention - of the professional mailbox after the employee's departure requires the explicit consent of the former employee concerned.
In this context, we also recall that it is forbidden by law to take notice of the content of an e-mail that is not addressed to you, except with the consent of all concerned. Thus, it is not allowed to automatically forward e-mails addressed to an employee who has left the company to a colleague for follow-up.