French employment law - GDPR (Banking Sector): Bank Employee Executive Obtains All Messages Sent and Received via Teams and Outlook (CA Paris, référé Oct 2nd, 2025)
In a ruling dated June 18th, 2025 (23-19.022) published in the official bulletin, the French Court of Cassation affirmed that emails sent or received by an employee using their professional email account constitute personal data within the meaning of Article 4 of the GDPR. The employee has the right to access these emails, and the employer must provide both the metadata (time stamp, recipients, etc.) and the content, unless the requested information is likely to infringe upon the rights and freedoms of others.
In a final judgment dated October 2nd, 2025, the Paris Court of Appeal ordered the disclosure of a copy of the full content of messages sent and received by Mr. X from his Outlook and Teams email accounts, excluding attachments, for the period from January 1, 2024, to October 8, 2024, under penalty of €20 per document per day of delay.
This judgment is final.
Article 145 of the Code of Civil Procedure provides that “legally admissible investigative measures may be ordered if there is a legitimate reason to preserve or establish, before any trial, evidence of facts upon which the outcome of a dispute may depend.”
Respect for the employee's private life and trade secrets do not, in themselves, constitute an obstacle to the application of the provisions of Article 145 of the Code of Civil Procedure, provided that the judge finds that the requested measures are based on a legitimate reason and are necessary to protect the rights of the party requesting them.
The right to evidence can only justify the production of material that infringes on privacy if such production is essential to the exercise of this right and if any infringement is proportionate to the objective pursued.
Their implementation is therefore not subject to a condition of urgency, nor to the absence of serious dispute, nor to the justified or presumed existence of a manifestly unlawful disturbance.
Indeed, in order to present evidence supporting a potential infringement of his rights, the employee needs to possess factual information that establishes any possible breaches by his employer. Since the summary proceedings court has the power to order the production of documents, the lower court's decision will be overturned insofar as it ruled that there was no basis for summary proceedings on the requests.
Furthermore, it is established in the proceedings that the labor court was seized on the merits by a petition filed on March 10, 2025, seven days after the summary proceedings order was issued. Regardless of whether this referral preceded the notice of appeal, Mr. X's "substantive" referral was subsequent to that of the summary proceedings court. It should also be noted that the company is not seeking to have the request for disclosure of documents declared inadmissible, as it is, in this case, admissible, but rather to argue that the request lacks legitimacy.
It is established that Mr. X was summoned to a preliminary interview, with a precautionary suspension, by letter dated September 20, 2024, and dismissed by letter dated October 8, 2024.
However, having referred the matter to the bank's joint committee on October 11, 2024, and with the committee issuing its opinion on October 28, 2024, his dismissal only became effective following a further notification on January 17, 2025. This notification initiated his three-month notice period, which the company ultimately waived.
It is also established that, following the precautionary suspension dated September 20, 2024, Mr. X no longer had access to his work email from 9:00 a.m. that same day. At that time, the company suspended all of Mr. X's access to Outlook and Teams, and this continued until the last day of his employment.
It is also accepted in the proceedings that the company transferred to him, on December 3, 2024, the elements contained in his personal file and on January 23, 2025, elements of his “Outlook” messaging (date and time) excluding their contents and the references of correspondents outside the company.
In light of the circumstances of his dismissal (precautionary suspension, referral to the joint committee, the nearly three-month delay between this referral and the final notification of dismissal, and finally, the waiver of the notice period and the suspension of access to his professional email accounts since the start of the disciplinary proceedings), Mr. X has a legitimate interest in obtaining evidence concerning his claims relating, firstly, to his dismissal for serious misconduct and, secondly, to his challenge to the validity of his fixed-day work agreement.
However, according to point (1) of Article 4 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), “personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”).
An identifiable natural person is any natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
According to Article 15, paragraphs 3 and 4, of the GDPR concerning the "Right of access of the data subject," the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.
The controller shall provide a copy of the personal data undergoing processing, provided that the right to obtain a copy does not adversely affect the rights and freedoms of others.
As a result, firstly, emails sent or received by an employee via their professional email account constitute personal data within the meaning of Article 4 of the GDPR and, secondly, the employee has the right to access these emails. The employer is required to provide both the metadata (time stamp, recipients, etc.) and the content, unless the requested information is likely to infringe upon the rights and freedoms of others.
While attachments or files may constitute trade secrets when sent by or to clients, the content of the messages constitutes personal data, and Mr. X is entitled to request its disclosure. It should be noted that the parties are reminded that this data may only be used within the framework of legal proceedings before the labor court and, if necessary, the court of appeal.
Regarding the restoration of computer access to the professional email accounts “Outlook” and “Teams,” the court notes that this request exceeds the legal provisions of the GDPR, which limits access to the disclosure of personal data and not to the company's IT applications. Given that the requester has not provided all the necessary information, it will be up to the courts to draw all appropriate conclusions.
Regarding the disclosure of “Outlook” calendars or computer connection times, the court notes that these requests do not constitute personal data as defined by the aforementioned provisions.
Therefore, Mr. X is granted the right to access the content of messages in his professional "Outlook" and "Teams" accounts, excluding attachments, for the period from January 1, 2024, to October 8, 2024. It should be noted that the company has already provided a list of its communications, including their dates and times, for the last three years of the contractual relationship. The other requests for direct access to his email accounts, or to the times he was connected to the computer system or accessed his calendars, are denied.
Regarding the other requests:
In light of the resolution of the dispute, a penalty payment is ordered, limited to €20 per document per day of delay, starting two months after the service of this judgment.
In view of the resolution of the dispute, the company will be ordered to pay all costs of the proceedings at first instance and on appeal, as well as to pay Mr. X the sum of 2,500 euros on the basis of Article 700 of the Code of Civil Procedure for the entire procedure.
To read the full article, please click on the link below.
Frédéric CHHUM avocat et ancien membre du conseil de l’ordre des avocats de Paris (mandat 2019-2021)
CHHUM AVOCATS (Paris, Nantes, Lille)
e-mail: chhum@chhum-avocats.com
https://www.instagram.com/fredericchhum/?hl=fr
.Paris: 34 rue Petrelle 75009 Paris tel: 0142560300
.Nantes: 41, Quai de la Fosse 44000 Nantes tel: 0228442644
.Lille: : 45, Rue Saint Etienne 59000 Lille – Ligne directe +(33) 03.20.57.53.24
Commentaires
Rédigez votre commentaire :
Les réactions des internautes
<% comment.content %>
<% subcomment.content %>