My question is regarding disciplinary procedures.

The scenario: An employee leaves an organisation and their responsibilities are then taken on by another employee who is now responsible for the former employee’s pc.

The former employee requests an ICT Administrator within the organisation to log on to the pc and check to see if a personal email from an identified sender and subject has been received. In order to access the user account on the machine the Administrator requests a colleague (also an Administrator) to reset the password. The administrator accesses the user account, checking the inbox for a specific email which is not present and logs off.

The employee now responsible for the former employee’s duty has since made a complaint to management because the administrator didn’t see it necessary to ask permission before accessing the machine on the grounds of sensitive data upon it. Has the administrator done anything to warrant disciplinary action of any level?

Is it correct that we have a legal obligation to provide the requested data (if in existence) as it relates to the individual?