For e-mail addresses, a distinction must be made between named (e.g. hans.meier@firma.ch or hans.meier@verkauf.firma.ch) and/or unnamed, functional (e.g. info@firma.ch, verkauf@firma.ch, or verkaufsleiter@firma.ch) addresses. Named addresses are used in most companies today. These personal addresses are fundamentally subject to personal rights and a superior may not access such addresses without further ado in the event of absence. Functional addresses, on the other hand, can be accessed because they do not relate to an individual person.

For access to named addresses, there is often a corresponding regulation in the IT regulations. In some companies, the use of a business address for private purposes is prohibited, but access to a private e-mail address is permitted (in urgent cases). Due to the widespread use of smartphones, this is usually not a problem. If the address may only be used for business purposes, some lawyers assume that access to the business email is permissible accordingly, since it concerns business messages. If possible, a person of trust should be appointed as a deputy who is allowed to search the mailbox for time-critical e-mails in the event of a longer absence and then set up an absence message. If the business address can also be used for private purposes, it should be agreed that such messages are to be marked. These should then be ignored during the screening process. Forwarding should only be done in cases where it is absolutely necessary or if it has been explicitly agreed. If private use is possible, a deputy should be appointed as a person of trust.

If there is no fixed regulation, a comparable ad hoc regulation can now be created. Each employee should designate in writing a person who may access the mailbox in case of illness or if no external access is possible in case of quarantine. This can be the supervisor, but since this is not always desired, a staff member should be given the free choice. Due to the high contagion rate, it is best to designate several persons so as not to be without a substitute in case of several failures.

"Third-party access to personal e-mail accounts must be carefully regulated within the framework of a set of rules."

- RA Yves Gogniat

If a person is already ill or in quarantine at home, the staff member must be asked by telephone to name a substitute. For reasons of proof, two persons should be present at the interview.

If the person cannot be reached, e.g. because the employee is in hospital, the mailbox should only be checked for urgent messages if absolutely necessary. In most cases, setting up an out-of-office message will suffice. In this case, the supervisor should set up the out-of-office message together with a second person, e.g. IT staff. A dual control principle at least reduces the risk of unauthorised access to the mailbox. Access should only be granted once.

If there are no company-wide guidelines regarding the wording of a notification of absence, the possibility of preparing a personalised notification of absence can already be pointed out when naming a deputy. It should also be mentioned that otherwise a standard message will be inserted.

This article was written by RA Yves Gogniat.

If you need assistance with data protection issues in connection with COVID-19, we look forward to hearing from you. Our partners Hans Kuhn and Balthasar Wicki will be happy to assist you directly.

Further links:

FDPIC: Access to mailbox in case of dismissal or illness

FDPIC: Guidelines for the processing of personal data in the workplace