Does all email pertaining to that person need to be deleted if requested by the Data Subject?
No; the company will always be able to justify retention on the grounds that they may need to produce them at a later date for a variety of reasons (as evidence in court or Tribunal, to a regulator, or for dispute resolution). The company must be able to demonstrate that the data is held securely, that it cannot be accessed except by authorised investigators, and that and access is audited. The company will always be able to point to vicarious liability issues if the Data Subject argues that these were ‘personal’ emails – whether personal use was permitted by the organisation or not. The only exception might be where a company has allowed personal use of the company email system and provided guarantees to employees that personal email will not be retained.
