8

What should be done with an employee's company email account after their termination?

We typically change their password and forward their email to another company account so that no sales leads, etc. are missed. Is this the best way to go about it? Is this legal?

  • 1
    @AnFi In an jurisdiction would a company not own their email address.? – paparazzo Mar 8 '18 at 22:22
  • What you’re proposing is the correct thing to do. You prevent the user from accessing the account, but let people still write to it and not lose business. – Snow Mar 8 '18 at 22:50
  • e.g. AFAIK in some jurisdiction former employee may have some rights to surname-email address. What will survive courts scrutiny is one thing, what may be challenged in courts is quite another especially in "special cases". Your proposal "receive/redirect but do not send with such surname-email address" is pretty good for most situations IMHO. – AnFi Mar 8 '18 at 23:04
  • 1
    @AnFi United States – JetSet22 Mar 9 '18 at 0:59
  • 1
    Don't just change their password. Make sure any authentication token, or cookies, get reset. HR and IT should develop a formal checklist to use for terminations. If you don't wipe almost everything clean, it's very easy to forget something. – Stephan Branczyk Mar 11 '18 at 20:22
6

As a systems administrator and corporate worker, this is not the correct way to do this.

As other people have stated, the email is company property and can be dealt with in any manner they feel proper.

I am writing this from a Microsoft perspective, but this applies to everything. Do not change the password. The account should be disabled. This will prevent anyone from logging in as that user. Do not delete the account from Active Directory, as this can cause dangling SIDs. This means, any documents created, edited, associated with that user still show that user properly. A knowledgeable systems administrator should know how to deal with this.

As for the email itself, generally you give another user read access to that email box and add it to their email client. This allows the user to read old email, as there may be important information in there that needs to be referred to. That user can then reply to old or new mail to he terminated user, with their own email stating that the old user is no longer with the company and that they are assuming responsibility for future contact.

Forwarding email to a shared group is not a good idea in general, as people can assume someone else is taking care of it and no one ends up replying. Or just as bad, multiple reply to an incoming email. One point of contact is the best way to go, unless there is some sort of ticketing system associated with the redirected email.

Depending in your business, local and federal laws, etc, you may be required to keep email for a certain amount of time. Check with HR and/or your legal team to see if there are any requirements that need to be met.

  • Although your recommendation sounds best... we use Google Apps for Enterprise and I do not believe that we can simply disable the email and give someone else read access? – JetSet22 Mar 12 '18 at 20:51
  • @JetSet22 unfortunately, i have not used that product. however, if it is an enterprise app, then im sure this is possible. contaact their support to find out. – Keltari Mar 12 '18 at 20:54
5

The email account belongs to the company, not the employee, so you can do anything you like with it except impersonate the ex-employee.

Many companies deal with this by not using personal names in email addresses and instead using job title. In that way when a person leaves the whole email account can be taken over by their replacement.

Your solution is widely used as well. In theory any emails coming to that account are work related and therefore important for the company to access.

  • 4
    Most corporate email addresses I've run across have personal names. The only exception is when there's a shared address for a department or role - sales@widgets.com, events@greatco.com, etc. – Snow Mar 9 '18 at 6:29
  • @Snow our experiences differ, either way the answer is valid enough. – Kilisi Mar 9 '18 at 8:12
  • 1
    @Kilisi our company has both, for example sales@company.com for sales and jsmith@company.com for John Smith who works at sales. John Smith would receive emails addressed to both addresses. – Cyonis Mar 10 '18 at 16:20
1

Company emails are not private. They belong to the company (which is one reason you should never use a company email for any purpose where you would not be ok if anyone/everyone in the company could read it). It is not the job of the company to provide personal email addresses to employees.

I would recommend exactly the behavior suggested in the question: change the password and forward emails to a monitored account.

-1

Most common method I've seen is to set the employee's out of office. You can say that the email address is no longer valid, and leave forwarding instructions for any party that may need to be contacted. That first step will filter out any personal or email spam, before messages go to someone else to action. This saves much more time then having every email forwarded, and avoids any unauthorized usage of someone else's email account.

  • Why would any usage the company makes of its own email account be "unauthorized"? – Philip Kendall Mar 13 '18 at 6:08
  • Because it could be interpreted as impersonating an individual, whether that was intended or not, no matter who was paying for an account. If someone else has access, if there was an event where email evidence was used, that person could say it wasn't them. – Stacy Mar 22 '18 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.