Right of access to an employee’s personal data: employers can be required to pay compensation if they fail to take action

Court of cassation, Labor Div., 18 June 2025, no. 23-19.022

Following the termination of his employment contract, an employee request access to e-mails sent or received via his work email account.

The company sent him various other documents (such as, for example, his end-of-contract documents).

When the matter was referred to the lower courts, they ordered the company to pay damages for failure to comply with the provisions of Articles 15 and 4 of the GDPR relating to the right of access to personal data.

The company appealed to the French Supreme Court, arguing that emails and sent or received by employees as part of their duties cannot constitute personal data.

However, this was not the position taken by the French Supreme Court.

After recalling the provisions of Articles 4 and 15 of the GDPR, it expressly confirmed that :

• Emails sent or received by employees through their professional email address are personal data under Article 4 of the RGPD,

• Employees haves the right to access these emails: the Court specified that the employer must then provide them with both the metadata (timestamp, recipients), and their content, unless the elements whose communication is requested are of a nature to infringe the rights and freedoms of third parties.

The Court adopted the terminology used on the French Data Protection Authority (CNIL)’s website. For the CNIL, the rights of third parties include intellectual property rights and business secrecy.

In the Court’s view, an employer’s failure to comply with these obligations without providing any justification is a breach of the employee’s rights, resulting in damages to be assessed at the discretion of the lower courts.