Employer wants to use my work email account after I quit, is this legal under German law? Is this a GDPR waiver?

Question

Background info: I am leaving my current job in the next couple of weeks. (If you want to know why just check my other questions.) Germany, Junior Developer

Yesterday I got a list of all the things I need to return before I leave. I didn't think too much of it at first. It had boxes to check what I still have and need to return and had a place for my signature at the bottom. But as soon as I started reading the fine print my inner alarm went of. It states (translated from german):

"I confirm that (company) is allowed to use my mail account unrestricted. This includes viewing all mails and using all messages for business Correspondence"

Original: "Ferner bestätige ich, dass (der Betrieb) ab sofort uneingeschränkt berechtigt ist, meinen E-Mail-Account zu nutzen. Dies beinhaltet diesen durchzusehen und die dort vorhandenen Nachrichten uneingeschränkt als geschäftliche Korrespondenz verwenden zu können. "

(I added the german original for context, because my english skills are far from perfect, maybe someone can translate it in a better way)

Now this seems odd to me for a couple of reasons. First of all: Why would this be on this list? It seems to me that they wanted me to sign it without thinking about it. Like: "Here I gave you all my stuff and we both sign it". The HR Person didn't tell me to look at the fine print either. She just said it is for the physical stuff I have from the company. Second of all: Why do I need to sign this stuff anyway? Wouldn't it be the responsibility for THEM to sign it after I returned my stuff? So I have proof I gave the stuff back?

Question: Is this common practice in Germany, or anywhere for that matter? Should I sign this thing at all? What do I have to lose, or to gain?

Side Note: There are no private mails on there I am worried about, but there are some business mails that are very confidential and should stay in the IT department.

UPDATE:

I usually agree with the most upvoted answer, but this time I decided differently. I did what the accepted answer recommended, which is not signing anything. Until now, almost 2 month later, I have not received any message claiming I did something stupid. If they have the legal right anyway, there is no need for me to sign it, and that was exactly what I told the nice HR lady who helped me with my offboarding process. She agreed and even signed a paper for me I set up to prove I returned everything. Alltogether I didn't sign anything when leaving. And I don't regret it. My old company might have looked a little surprised by this, but they didn't push me to sign it afterwards.

Thank you for all your answers.

Answer 1

Question: Is this common practice in Germany, or anywhere for that matter? Should I sign this thing at all? What do I have to lose, or to gain?

Whether this practice is common or not, don't sign anything. Simply return all the physical materials and do not alter/destroy any electronic materials. If they want to use your mail account for any ( legal ) reason, that is within their rights as it is their property.

The bottom line, don't sign the document, you gain nothing from doing so.

Answer 2

Your corporate email account doesn't belong to you, it's not confidential to you - it belongs to the business.

You need to allow access to that mailbox after you leave so that the business can look to see if there's any emails that are valuable or have information that isn't anywhere else.

Normally, a forwarding system will be enabled so that any future email being sent to your old corporate account will be forwarded to your manager instead.

If you have any concerns about individual email items in your account, then it seems reasonable to notify your manager and let them decide what to do about those.

You don't have anything to lose, or anything to gain from this - it's just part of the process of handing back company property.

It's likely that this clause is here to mitigate any possible claim of impersonation and for you to formally hand the exclusive access of the account over to your company.

Answer 3

Your emails on your company email address stored on company server is the property of the company.

You sign this to say "Yes I understand that" which by your question is not so clear.
Emails on your inbox are not for you. They are for your company and you to view them as a company representative. Company NEED to look at them to know what you were working on, to which customers reply about change of representative or to pass knowledge about them to the next person hired.

According to GDPA (German Data Protection Authorities)

The employer may access sent and received emails of the employees during a longer period of absence, if it is necessary for business purposes

But the employer is also obliged to deactivate the account "As soon as possible". And they need to know what you have in there to decise when is that "soon".

This fine print is for them IF you decide to drag them to court because you think you left some personal email and then blame them for something in your life.

Answer 4

I think the key question here is "Does this authorize the company to write new e-mails using your e-mail address even if you don't work there anymore". The wording (even in German) isn't entirely clear on that.

"Ferner bestätige ich, dass (der Betrieb) ab sofort uneingeschränkt berechtigt ist, meinen E-Mail-Account zu nutzen."

Technically that gives them unrestricted use of your e-mail account which could include "impersonating" you in future correspondence. While that would unusual and rare, I've actually seen it happening.

You should ask for clarification. Your company as full access to all your existing e-mails anyway but you should insist on adding a statement that the company should close the account and is not allowed to write new e-mails in your name.

Answer 5

If I was being asked to sign a legal document, the first question I would ask is "what do I gain from signing this?"

If the answer is nothing, or something like "it's just a formality", then be very wary.

I worked at an IT company some years ago and on my last day they asked me to sign a document which would have the effect of making any work I did during my employment, both within and outside work, their property.

My first question was what were they willing to offer me to sign it. When the manager responded that it's just a formality, they weren't offering me anything to sign it, and I was just expected to sign it, then I responded that in that case if it's "just a formality" then it didn't really matter if I didn't sign it. He wasn't happy, but there was absolutely nothing he could do about it.

Lesson for them: next time put it up front in the employment contract. That is the document which sets out the conditions of the agreement under which you are employed and compensated.

Lesson for me and you: always be wary of signing documents. An agreement which disadvantages you without any compensation is not in your best interest.

Answer 6

When quitting, sign nothing without contacting a lawyer. You can never know of every pitfall that might be there. If you can´t afford one, don´t sign.

I`m from Germany too, and left my longtime employer quite recently. I didn´t have to sign anything - it was a very fair employer. I read a lot about leaving, though, and there are quite a few tricks going on in Germany (and maybe somewhere else, too), for example letting you sign "all further claims satisfied" ("alle Ansprüche abgegolten"), which means you won´t get things like holiday pay (Urlaubsgeld) or profit-sharing (Gewinnbeteiligung) if it would have to be paid after your leaving. Having to sign anything after quitting would leave me suspicious because of such bad practices buzzing around. It should be the other way round - them signing you left everything behind that has to be left, as a confirmation they don´t have any claims on you.

You should copy the form and let them sign it, just for your reference. Just in case, you know.

Now to the mail account:

My former boss asked me if I was ok with them "using" my content (only orally - no signature). When I said yes, he asked me to delete every private mail from the account. I answered but I don´t have any - I always respected the company rules of not using the mail account privately. He told me he´s not interested if I used it privately, but if I did, please clean up.

One thing I did to prevent him (and others) from having to write any mails using my mail account was leaving the account with a delegate rule - an auto answer with vaguely following content:

I´m out of office. For information on current projects please contact the respective project leader. For all other requests please contact my team leader.

I informed my former boss of doing so, so he knows he doesn´t have to "use" my mail account for writing, as every potential contact is already informed.

Answer 7

I can't say if this is usual or any problem with it. But I can suggest how I would solve the underlying issue.

From time to time, like everyone, I have had prewritten contracts or documents to sign. Sometimes a clause worries me. In that case, I write next to it, anything important, then sign. They might not like it, or claim it can't be done, but if I do it and present it as "done", they usually allow it by default.

In this case I would simply write next to it, "** but not to send emails purporting to be from me, or impersonating me" (or whatever your concern is). Then I'd sign and keep a copy or photo for my own records, happy that my concern was taken care of.

The odds are good that anyone seeing it, will see it is commonsense and harmless, and at most feel you are over worrying. Which is fine, it's your peace of mind that matters, not theirs, so let them think that, and tell them it is your worry, not theirs, and that's how it is.

As for the very private work emails, you are leaving. It's their choice what happens to these, not yours. If it is a real concern, mention it to your manager, and let him handle that aspect. It's no longer yours to control after you leave.

Answer 8

AFAIK in Germany the law says that the employer has the right to access any e-mails on the corporate account that you have written or received, unless they can readily identify the message as private. This is of course a big pitfall for the employer: if one of your colleagues is given access to your mail after you leave, they should be able to use it efficiently. If they are searching for e.g. an invoice, they will have to carefully check the subject of every e-mail before opening it (so that they don't accidentally open an e-mail with invoices for your personal stuff), and that of course takes a lot of time.

Different employers deal with this regulation differently. Mine made me sign a form which says I will keep my private e-mails in a separate folder with immediately recognizable name like "Privat", and give them the right to search everywhere else. Needless to say, they made me sign this form when I got my account, so that rules have been clear from the start. Your employer screwed that up a bit, and now they want to make things right retroactively by making you give up a bit of your rights.

Of course there's no law that obliges you to sign a document when you leave the company, else there woundn't be a need to ask for a signature. However, if you don't have any messages in your corporate main that you rather wouldn't disclose (and you shouldn't!), my advice is to cooperate and sign the form. Your employer has good reasons to ask for it, and cooperating will play in your advantage if you ever need recommendations from them.

If you do have personal stuff in your mailbox that you'd rather have removed, approach HR and tell them that. Chances are that they will be happy to give you access to your mailbox so that you can clean that up.

Disclamer: I'm not a lawyer but I used to play one on TV.

Answer 9

Personally I would refuse to sign anything as a condition for quitting. My first thought is that they are lawfully allowed to view and inspect properties they own with email accounts being one of them.

I confirm that (company) is allowed to use my mail account unrestricted. This includes viewing all mails and using all messages for business Correspondence

I highlighted bold the concerning part for me. What exactly does "my mail" mean? Company emails are by definition not "my mail" but "company's mail." If this is verbatim copy of their contract, I would refuse since the term "my mail" is left unrestricted. They own the "company mail" so it was never "my mail." Do they mean they can impersonate you? Or simply view contents of your work email that they own?

Is this common practice in Germany, or anywhere for that matter? Should I sign this thing at all? What do I have to lose, or to gain?

Yes last company I left has my email account. What my company does is simply use to to see if I have any cron jobs or emails that are only sent to my account then go hunt the script down to change the email. It's rare this happens but in the past, we had one worker left and he left a job running and once we changed server we realized it was critical and since he only got the email, nobody knew.

Answer 10

Let's face the elephant in the room which everyone is ignoring.

The HR Person didn't tell me to look at the fine print either. She just said it is for the physical stuff I have from the company.

Assuming you were told exactly as you said. The electronic mailbox is not physical stuff. HR is being incompetent (don't think so) or lying (most likely). They are being sneaky, trying to get you to sign something without you noticing it.

If it was such a non-issue, why not being open and talking about it directly? Beware.

So, don't trust them. Tread carefully. Do not sign anything at all unless you have a very good reason to sign. You gain nothing from signing this. If things go really wrong and you find yourself in a trial you will regret having signed this since it will strengthen their position. If things go well you won't regret not having signed this.

Answer 11

With the addition of GDPR which affects you, one of the rights you have is the "right to be forgotten".

If you have any personal emails you can ask for this to be excluded and deleted from backups. Any email that is personal in any shape or form you can have excluded.

If the emails you are concerned about are regarding your team's work and not regarding specific members of your team on a personal level, then the company has the right to use them. Any emails that may contain personal information from your colleagues or anything like that you can also request to have deleted and forgotten.

Other than that, this seems above board to me. They won't be able to use your email address other than set up the usual "out of the business" auto reply.

Answer 12

Ask your Betriebsrat (working council).

• They will know what "Betribsvereinbarungen" are in effect
• They will know what the legal situation or refer you to a lawyer
• Until then: What happens if you cross don't sign, or cross the paragraph out and sign?

This is probably less a thing about GDPR, but more about a few other laws.

Answer 13

"I confirm that (company) is allowed to use my mail account unrestricted. This includes viewing all mails and using all messages for business Correspondence"

I think the best thing to reply is, "Ok, I will audit the entire mail history and remove any personal emails that happened to be here before I sign this." This will lead to a lot of debate over the matter where they will try to claim they have the right to the whole thing anyway, which is not actually true. They probably don't want you going through and deleting a bunch of stuff to sabotage them so they will be leery about actually granting this.

In fact this happens a lot where the work email gets used for some personal use because it's monitored during work hours. That doesn't make all the emails therein the company's. We generally have rules the other way around about sysadmins not snooping in employees email accounts. These rules make sense because it's not solely the company's stuff in there.

If the company really wants the rule to be all the email is the company's and all of it is available for company inspection at will, this is the kind of thing that needs to be disclosed on the first day, not the last day.

Full Disclosure: My employer keeps ex-employee mailboxes around and keyword-searches them as needed. The person doing the searching is trusted to not read sensitive stuff and other miscellaneous browsing but only find the material required and use good quality filters to avoid seeing sensitive stuff in subject lines. The actual need to do this comes up only a few times per year, and only a few trusted employees have the power and there's never been an incident of abuse (small company).

Answer 14

They are not allowed, except...

The problem is that the employer is not allowed to see your private communication with others. Yes, they are allowed to see the communication of their company mailbox, but they are not allowed to see the possible private communication what you did there. If you did not sign some paper, that you won't use your company mailbox for private communication (or that you allow them to see it if you did), then they have nothing to guarantee that they did not see your private mails.

By my German employer, all the mailboxes, company laptops and so on, are completely deleted, without even checking their content, if someone leaves us. There is still a strong company security, but it works on proactive and not on retroactive ways.

Other employers - particularly big companies - are enough hostile to even log your https traffic. I don't know, how would they react for a vpn-over-https double encryption, but possibly they would interpret it as a hack attempt. Its most likely consequence: firing on the spot, on a nothing-saying reason (they don't want "skandal", they would want to eliminate you ASAP). However, they pay quite well, compared to some neighbouring regions/countries, so it is better to not play network eavesdrop games with them. Instead, be happy on your bank account everytime as your money arrives, and try to motivate them to employ you long term. And never, never do anything what could awake the sleeping lion.

Use your private mailbox for private communication. Probably you can't do it on a way that they won't see it (and should not invest effort to make it better protected - focus on to make your job better protected by good work), but they can't eavesdrop it without you would know it.