A recent decision from the French Court of Appeal (available here in French) has confirmed that employees cannot rely on their right of access to obtain copies of entire work email correspondence or business files, merely because their name or email address appears in them. Where the material contains no substantive personal data beyond identifying information, the right of access does not extend to wholesale document disclosure.
This will be welcomed by data controllers, who regularly face broad, tactical and (increasingly) AI generated DSARs from employees, particularly following grievances, dismissals or during settlement negotiations.
Background
An accounting inspector was dismissed by a French notaries' association for professional incompetence. Following his dismissal, he requested all emails sent and received via his work email account, plus files stored on his computer. The employer refused, so the employee brought proceedings arguing that he was entitled to this material under the GDPR. The Court of Appeal rejected his claim.
What the Court said
The Court outlined the following, regarding the right to access personal data under the GDPR:
'The purpose of [Article 15] is not to obtain a copy of the email correspondence sent or received by the employee in the course of their work, which they have, by definition, had full access to, and which, unless they can prove otherwise that it is personal, contains only their identification (here, Mr [K]'s email address and...
Ghana Link Network Services Ltd., operators of the Integrated Customs Management System (ICUMS), has denied claims that the platform was down since Friday, March 6, 2026, causing fuel supply disru...