The mailbox of someone who left: the processing nobody documents

It is worth resisting the temptation to file this as a Belgian affair. Of all the processing an organisation carries out, the mailbox of someone who has left is probably the most universal and almost always the one missing from the register. Nobody decides it: it happens. On the day of departure the account stays open because «something important might come in», a month later nobody remembers to close it, and a year later there exists a container of one person's correspondence, that person no longer being there, read by colleagues she never authorised.

The argument heard in defence of the practice is always the same: legitimate interest in business continuity. The argument is not ridiculous, it is simply much shorter than the use made of it. In the days immediately following a departure there genuinely is an interest in not losing an order or a deadline. That interest is exhausted once correspondents have had time to change the address, and that time is measured in weeks. Beyond it, what remains is not continuity: it is the convenience of not having reorganised anything, and convenience is not a legal basis.

• The mailbox must be deactivated no later than the day the relationship ends. Not «as soon as possible»: that day.
• In its place an automatic reply giving an alternative address, without explaining where the person went and without giving out her private contact details.
• After a reasonable period — in principle one month, extendable to three at most with documented reasons — mailbox and automatic reply are both deleted.
• The content is not read. If a document is genuinely needed, it must be located by a targeted, documented search, with the data subject informed beforehand.
• The person must know all of this before leaving, not discover it afterwards: this is the duty to inform, not a courtesy.

For a DPO there are four things to put in writing, and none of them needs a project: the entry in the register of processing, with purpose, basis and separate deadlines for deactivation and for deletion; the paragraph in the staff privacy notice describing what happens to the mailbox after departure; the offboarding procedure that assigns one named person the task of closing it, with a date; and a record of any access to the content, if access there was. Without the fourth, the organisation cannot demonstrate that nobody read anything, and the burden of proof is its own.

One detail about the automatic reply, because it is the part most often written badly. «Our colleague no longer works here, you can reach him at this new address» tells anyone who writes something about the career of a person who never asked for it to be disclosed. The correct text says two things and then stops: that the address is no longer in use, and which address to write to instead. Not the reason, not the destination, not the good wishes.

What to do today, concretely. Anyone running compliance in an organisation can establish in half an hour how many mailboxes of departed people are still active, for how long, and whether any is forwarded to a colleague. If the number is not zero, no impact assessment is needed: what is needed is a list with a date next to each line. The Belgian decision did not establish a new principle — the authority's line has been the same at least since 2020, when a company was fined €15,000 for addresses left open when collaborators departed. What has changed is the price.