Ex Employee mailboxes and GDPR

[sat_s]

Hi,

 

If a staff member has left and their AD account has been disabled, we are assuming that their O365 mailbox is disabled too, but not deleted.

 

However, if a staff members AD account has been deleted, their mailbox is soft-deleted and then finally deleted within Microsoft O365 after 30 days with no way of retrieving it.

 

Now, if an account has been disabled and remains that way for a year or more, then:

1. Are we allowed to do this? Should we be keeping disabled accounts for that long?

2. Are we allowed to recover their mailbox and pass the mailbox to HR or SLT to allow them to search through it, if there is a legal case or disciplinary case going on against that staff member?

3. Are we allowed to backup a staff members mailbox in pst format, delete their mailbox and then store their pst file in "cold storage" if and when required?

 

Help and advice on this GDPR issue would be appreciated.

Edited July 12, 2019 by sat_s

[Ditto]

Can you find in your school policy documents any statements about data retention? I also suggest reading through the following two threads:

http://www.edugeek.net/forums/data-protection-information-handling/196794-email-retention.html

http://www.edugeek.net/forums/data-protection-information-handling/206718-irms-toolkit-schools-updated.html

[Dos_Box]

Moving to the correct forum.

[psydii]

The disciplinary process should have been started before they left, and so the mailbox should be retained for at least the period of the investigation + appeals process. I would seek specific legal advice on this with LA/Trust HR/legal team.

 

More generally, you should only keep email for as long as your record keeping policy mandates. Our DPO wants us to basically delete email within a few months of receiving it. I think this is excessive, but ultimately they are going to win.

 

I would pass this problem to your DPO.

 

I would argue that if current practice is for staff to store/archive currently relevant information in their mailboxes then it is reasonable to keep ex-staff mailboxes until such information stored within them is irrelevant. However, I would also suggest that information that is old/stale or has no valid specific reason to have been kept be filtered out of any discovery process.

Edited July 15, 2019 by psydii

[GrumbleDook]

More generally, you should only keep email for as long as your record keeping policy mandates. Our DPO wants us to basically delete email within a few months of receiving it. I think this is excessive, but ultimately they are going to win.

 

You only keep *information* as long as you need it ... the format is irrelevant. If the email has been dealt with and information recorded elsewhere, why keep the email? If you need to keep it then have an email retention policy set up so you simply label it not for deletion ... and it is not deleted. Apply that label to folders within your mailbox and put mail in the relevant folder (helping to make it easier to find at times too).