united-kingdom
Former organisational email address taken over after resignation [UK]
<p>I have recently resigned (under circumstances of conflict) from a voluntary director role on the board of an organisation.  This organisation used G-Suite to manage documents and a director email list.</p>
<p>As is standard, upon my resignation, my account was locked and should have been archived.</p>
<p>However, I've just received a security alert from Google, indicating that my password has been reset by the admin (another director) and that someone has now logged in to the account.</p>
<p>I only used the account for professional purposes, so there is nothing untoward for them to find.  However, they are now able to receive new email as me, and impersonate me if they wish.</p>
<p>Recovering the account through Google is not an option, as Google directs me to &quot;Contact your domain admin for help&quot; if I use the &quot;forgot password&quot; button.</p>
<p>Is this covered in any way by any data protection act or digital privacy act, or is this something that an organisation who hosts email is allowed to do?</p>

<h2>It is, and always was, their account</h2>
<p>Email accounts belong to the account owner, not the individual who uses the account.</p>
<p>If they were to use the account to impersonate you, that might be illegal. However, if they use it for archiving purposes, to access the contract lists within it and to advise that you are no longer with the organisation, that’s fine.</p>
