Publié le 01/07/2025

French labour law - GDPR - Emails sent or received by an employee via their email account = personal data to which they have the right to access (Cass. Soc., June 18, 2025, 23-19.022)

Article juridique - Droit du travail

In a decision dated June 18, 2025 (23-19.022) published in the Bulletin, the Court of Cassation affirmed that emails sent or received by an employee via their professional email account constitute personal data within the meaning of Article 4 of the GDPR and that the employee has the right to access these emails, with the employer required to provide them with both the metadata (time stamp, recipients, etc.) and their content, unless the information requested is likely to infringe the rights and freedoms of others.

This very clear position of the Court of Cassation is to be welcomed.

Employees must take advantage of it.

1) Analysis.

1.1) Employees' work emails = personal data within the meaning of the GDPR.

Obtaining emails sent and received from their work emails is the crux of the matter in labor court disputes.

Whether it's to prove harassment, failure to monitor workload and/or overtime, or failure to comply with daily or weekly working hours, obtaining emails sent or received by an employee via their work email is crucial in a dispute.

Companies are well aware of this.

They systematically block access to the work email of employees in the process of dismissal, often as soon as they are summoned to a preliminary interview.

One of our clients was disconnected from their work email after leaving La Poste after they had attended their preliminary interview. In this decision of June 18, 2025, published in the Bulletin, the Court of Cassation affirms that emails sent or received by an employee via their professional email account constitute personal data within the meaning of Article 4 of the GDPR.

In a decision of February 27, 2025, RG 24/02772, the Rennes Court of Appeal had already reiterated that messages sent and received from an employee's professional email account constitute "personal data."

The Court of Cassation recognizes professional email as personal data.

There is no longer any ambiguity.

1.2) The employee's right to access their emails. The employer must provide them with both the metadata and their content, unless the information requested is likely to infringe the rights and freedoms of others.

The Court of Cassation affirms that the employee has the right to access these emails. The employer must provide them with both the metadata (time stamp, recipients, etc.) and their content, unless the information requested is likely to infringe the rights and freedoms of others. In a landmark ruling dated December 19, 2012, the Court of Cassation previously held, regarding an employee's request for the production of his colleagues' employment contracts, amendments, and pay slips, that "respect for the employee's personal life and business confidentiality do not in themselves constitute an obstacle to the application of the provisions of Article 145 of the Code of Civil Procedure, provided that the judge finds that the measures requested are based on a legitimate reason and are necessary to protect the rights of the party requesting them."

Under Article 15 of the GDPR,

"the data subject has the right to obtain from the controller [...] access to such personal data." Article 15, in points 3 and 4, further adds that

"the data controller shall provide a copy of the personal data being processed," specifying that "the right to obtain a copy referred to in paragraph 3 does not adversely affect the rights and freedoms of others."

The CNIL also states that:

"When a data subject wishes to exercise their right of access to emails, the employer must provide both the metadata (time stamp, recipients, etc.) and the content of the emails." If "The rights of third parties (business and intellectual property secrets, right to privacy, secrecy of correspondence, etc.) may restrict the range of data accessible or communicable"... When the employee has already had, or is presumed to have had, knowledge of the information contained in the messages covered by the request, the communication of the emails is presumed to respect the rights of third parties."

Also, in a judgment also published on October 3, 2024 (No. 21-20.979), the Court of Cassation had already ruled that, provided these conditions were met, the provisions of the GDPR cannot prevent the communication of the requested documents, provided that the processing of the data communicated to the employee for evidentiary purposes complies with the legality conditions of the GDPR.

Sources.