In a decision dated 20 February 2026 (French Council of State, 20 February 2026, No. 497066), the Council of State held that the mass forwarding of confidential work emails by a protected employee to personal email accounts constitutes misconduct of sufficient seriousness to justify disciplinary dismissal, even where it is carried out for the purposes of exercising defence rights.
The facts
A social worker, a protected employee at a medical-social facility, forwarded several hundred emails from her work email account to her personal email account as well as that of her spouse.
These messages contained sensitive personal data relating to individuals receiving care in a medical-social facility, subject to professional secrecy and strict confidentiality obligations set forth in both the employment contract and the internal regulations and IT policy.
The employer sought authorization to terminate the employee.
The labor inspector refused, but the Minister of Labor ultimately authorized the termination.
This decision was overturned by the Administrative Court at first instance, and subsequently by the Administrative Court of Appeal, which held that the employee had acted with the aim of preserving her right to a defence, in a context of concerns regarding her career progression.
The decision
The Council of State overturned the Administrative Court of Appeal’s ruling.
It noted that the dismissal of a protected employee on disciplinary grounds requires that the alleged misconduct be sufficiently serious, assessed in particular in light of contractual obligations and the requirements of the position.
In this case, several factors indicate a particularly serious breach of these obligations:
- the mass forwarding of work emails;
- the sensitive nature of the data, relating to individuals receiving care in a medical-social facility;
- the transmission to a personal email account and that of a third party;
- the explicit obligations of confidentiality and professional secrecy incumbent upon the employee.
The Council of State specifies that, even if the third-party recipient (the spouse) had no personal interest in accessing the data, this transmission is still likely to compromise sensitive information.
It adds that professional secrecy may be lifted, if necessary, only to the extent strictly necessary to defend one’s rights.
Consequently, by finding that these facts were not sufficiently serious, the Administrative Court of Appeal incorrectly characterized the facts.
In practice, this decision confirms that, even for a protected employee, the retention of information for the purpose of self-defence must remain strictly proportionate and cannot justify the mass transfer of confidential data, particularly to personal email accounts or third parties.
