Your Work Email Is Not Your Personal Inbox

Most of us have probably done it at some point. Used our work email address for something that has absolutely nothing to do with work. Maybe it was convenient, maybe it was the email account already open, or maybe we simply didn’t give it much thought.

A recent case from the Office of the Privacy Commissioner (Case Note 329928 [2026]) is a useful reminder that where personal information is stored can matter just as much as what the information is about.

The case involved an employee who had used their work email address to send emails relating to a personal dispute that was nothing to do with the employer. Some of the emails were highly sensitive, including emails with a lawyer seeking legal advice.

The other party in the dispute made a request under the Privacy Act for personal information about themselves held by the employer, and some of those personal emails fell within the scope of that request.

If an employee uses their work email account for something entirely personal, does the employer actually “hold” that information for the purposes of the Privacy Act? The Privacy Commissioner concluded that it did. The emails were stored within the employer’s systems, and the employer was able to access and retrieve them. That meant the information was within the employer’s possession and control, even though the content was personal and some of it was legally privileged.

Therefore, once personal information is placed into an organisation’s systems, whether that is email, Teams, shared drives, or other workplace technology, the organisation may find itself holding information it never intended to collect, and the employee never really thought of as organisational information.

In this case, the Privacy Commissioner considered that the employer had proper grounds for withholding the emails from the person making the request. Mainly that releasing them would have involved an unwarranted disclosure of another person’s affairs.

The employer had attempted to rely on privilege as one of the reasons for withholding some of the emails. But the privilege belonged to the employee who had sought the legal advice, not the employer. The employer therefore could not rely on that particular withholding ground, although other grounds still allowed the information to be withheld.

Personal information does not always sit neatly in the systems where you expect to find it. It can be buried in employee inboxes, attachments, collaboration tools and other parts of the technology environment. When a Privacy Act request arrives, understanding what information the organisation actually holds can therefore be considerably more complicated than searching the obvious customer or HR systems.

The Privacy Commissioner also cautioned employees to check their employer’s policies before using work email for personal communications, particularly where the information is sensitive or privileged. Putting that information into an organisation’s systems creates a risk that it may subsequently be captured by a privacy request.

Perhaps the simplest rule is also the easiest one to remember “If it is personal, sensitive or something you would rather your employer never had to consider as part of a Privacy Act request, use your personal email.”