The solution depends mainly on company policy. If the company policy is that company computers are not to be used for personal purposes, and the employer need to access staff computers for handling company businesses, then employer may access the staff computers and the data therein (including emails). If the staffs are allowed to use their work computers for personal purposes, then staff should be required to have their personal files marked "private". The employer may access the staff's work computers in the staff's absence, but should not access the files or emails marked "private". If so, the employer should describe in the personal data collection statement the circumstances under which the staff's non-private files or emails would be access. The employer then conducts the access and review in accordance with the statement, to avoid breaching the law, and have practical management of the workplace. Where staff are allowed to use work computers for personal purposes, and there is no sign of computer abuse or law-breaking, if the employer accesses and reviews the private files of the staff (knowing that they are staff's private files) in breach of the statement of personal data collection, then his action would constitute processing data for purposes other than that of its collection, and it would constitute an administrative offence under Article 33 of Law 8/2005, the Personal Data Protection Act.