Partnerblog
In its decision of 7 October 2025, the Litigation Chamber of the Belgian Data Protection Authority (DPA) confirms its strict guidelines on closing professional mailboxes and linked email accounts upon termination of employment. The DPA ruled that similar principles apply to the continued use of a professional mobile phone number used during employment.
Facts
A former managing director filed a complaint because his professional email account and mobile number remained active for months after the termination of his employment. Several months after leaving, he requested the company to deactivate the account and mobile number and delete personal messages.
The company replied that the mailbox would soon be closed but claimed ownership of the mobile number. It was established that the email address remained active for five months and the mobile number was still in use eight months after termination of the employment.
Decision
Purpose, minimization and storage
The DPA held that the principles of purpose limitation, data minimization, and storage limitation are violated when a company keeps the professional e-mailaccount and mobile number after termination of employment.
According to established DPA case law, the professional e-mail account is personal data. To comply with the principles of purpose limitation, data minimization and data storage, it must be deactivated on the day of the employee’s factual departure at the latest. Only an automatic message can be placed informing correspondents that the employee has left the company and providing alternative contact details. The former employee must be informed of this deactivation. The employer can no longer have any access to the former employee’s e-mailaccount after his departure. Please note that the DPA repeats that if the content of the email-account needs to be retrieved for the proper functioning of the organization, the employer must take appropriate measures to obtain the content before the employee’s departure and, if possible, in his presence. After a reasonable period (in principle one month) the mailbox and automatic message must be deleted. This period can be extended to ideally no longer than three months, considering the context and level of responsibility of the former employee. This extension must be properly justified and either agreed upon, or at minimum communicated to the employee.
In line with its decisions on the professional e-mailaccount, the DPA stated that the mobile number itself, as well as the communications associated with it, are inherently linked to the individual. Processing this information must therefore be considered as processing the employee’s personal data. By continuing the use of a professional mobile number and not immediately deleting the information linked to the mobile number upon departure, the employer is in breach with the aforementioned principles as the initial purpose (professional communication) is no longer present and the duration of retention is unclear. The fact that the employee worked for the company for more than 10 years and had been allowed to use the mobile phone for personal contacts was considered aggravating circumstances as also private communications were kept.
Lawful processing
The principle of lawfulness stipulates that any processing of personal data must be based on a legal ground, such as the performance of a contract. During employment, managing and using the professional mailbox and mobile number is necessary for the performance of a contract, namely enabling professional communication. This legal ground is evidently no longer present at the moment of termination of the employment. Keeping the mailbox and mobile number active after termination must therefore rely on a new legal ground.
In principle, the DPA accepts that a company may invoke its legitimate interest, specifically ensuring continuity of operations and the proper functioning of the business, by keeping the e-mailaccount during a specific period with the aim of the automatic sending of standard communication regarding an employee’s departure.
In this case, the DPA concluded that the employer has not invoked a new legal ground that justified keeping the email address active or the continued use of the mobile number.
Sanction
At the time of the decision, the company was in liquidation and no longer carried out operational activities. The DPA therefore limited the sanction to a reprimand and did not impose an administrative fine.
Key takeaways
In line with its decisions on the email account, the DPA clearly states that if there is no legal purpose and no legal ground for the continued use of the mobile number, the company can no longer use the mobile number after termination of employment. It is not entirely clear if the decision implies that the mobile number must also be deactivated and even removed ensuring that nor the employer nor the employee can use the mobile number after termination of the employment.
If the employee has the right to reclaim the mobile number after termination, the number does not need to be deleted. It could in our view also be argued that the mobile number may continue to be used within the company, provided it is made clear that the number no longer belongs to the former employee.
The employer could allow the former employee upon departure to retrieve and delete any data linked to the mobile number from the smartphone. It could be argued that the mobile number could be kept for one month (ideally not longer than three months) limited to setting up a voicemail message informing callers that the employee no longer works for the company and indicating the number to call to reach someone within the organization using legitimate interest as legal ground.
Companies are strongly advised to implement a clear policy for deactivating professional email accounts and mobile numbers upon termination. Automatic messages/voicemail messages should be set up promptly, the employee must at least be informed, and the e-mailaccount and related communications and the mobile number and information linked to the mobile number should be deleted within a reasonable timeframe, unless there is a valid legal basis to continue using the mobile number within the organization (for example, by assigning it to another employee).
Authors:
