In a judgment delivered on 5th October 2018, in the names of Doreen Camilleri vs Information and Data Protection Commissioner, the Maltese Court of Appeal (Inferior Jurisdiction) decided an appeal from a decision of the Information and Data Protection Appeals Tribunal (the 'Tribunal').
The case related to an ex-employee of the European Union Programmes Agency ('EUPA') who claimed that her data protection rights had been infringed when following termination of her employment, the password to her work email inbox was changed, denying her access to the same while the EUPA's access to such work email inbox was retained. Ms Camilleri originally brought a complaint before the Information and Data Protection Commissioner ('Commissioner'), who had found that the EUPA had acted in compliance with Maltese data protection law. The complainant then appealed such decision before the Tribunal which also turned down her request, leading her to file a case before the Court of Appeal, which resulted in the present judgment. The Court of Appeal accepted the claims made by Ms Camilleri and revoked the decisions delivered by both the Commissioner and the Tribunal.
• A work e-mail address containing an individual's name and surname is to be considered personal data.
• The fact that an IT manager might have access for a short period of time to an employee's email account does not necessarily mean that every time the inbox was checked, processing of personal data of that employee had taken place.