I'm curious about how different organizations handle requests for access to email accounts of former employees. Specifically, when a user leaves a company and their account is deactivated or archived, there are times when other employees ask for full access to that account in order to retrieve information. I have concerns about this practice as it could expose sensitive data, such as performance reviews or HR-related information. Instead, I've been asking what specific information they need and using our e-discovery tool to find it. While most are okay with this approach, some do insist on having full access. How does your company manage these types of requests? Are there specific policies in place?
5 Answers
Ultimately, the company's policy is clear: the email belongs to the organization, not the individual. Access can only be granted if HR gives the green light, especially to ensure compliance with privacy laws.
We let the former employee's manager have temporary delegate access for 30 days post-termination so they can gather important info if needed. After that time, unless HR specifically requests to extend access, we purge the account.
It typically depends on the level of the requester's authority. Generally, a user's manager can request access, but we don't give it to their direct coworkers or replacements. Everything goes through HR for approval to ensure sensitive data isn't misused.
For us, all requests go through HR and usually require approval from a higher-up like a director. Even then, the requester must specify what they need to access. It keeps things transparent and above board.
We handle it by having HR approve all access requests. If a manager needs something, they can request it, but the reason has to be clearly stated. It helps to avoid potential conflicts, especially if there are HR issues involved.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures