Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder. Could Bob issue a subject access request (SAR) to Hotmail for the message (provided it is in fact still) held by Hotmail in Alice's inbox?
Or suppose Charlotte emails Dave, who uses a different email provider from him. Could she submit an SAR to Dave’s email provider for the message she sent to him, provided it is held by them?
An Art 15 Subject Access Request (SAR) “shall not adversely affect the rights and freedoms of others.”
It would be a grave violation of privacy for an email provider to search its users' account contents. It is therefore likely that the email provider would refuse to fulfil that subject request, unless required to perform a search via a court order. Instead, the SAR could be directed to the account holder (Alice or Dave), if they are subject to the GDPR.
Depending on the exact legal framework, emails might be protected under confidentiality of communications rules, making such searches similarly illegal to wiretapping. At least in germany, I am fairly certain that an email provider would be criminally liable if they were to disclose emails from their users' email accounts to a third party.
I am not a lawyer and I am not aware of such a case being decided in court yet. So this i my interpretation of the law:
Suppose Bob emails Alice, and both use Hotmail for their e-mail provider. Bob then deletes the message from his sent mail folder.
You are assuming the inner workings of Hotmail. The law does not care what is visible in your "sent mail" folder. The law cares about what is in Hotmails databases.
Could Bob issue a subject access request (SAR) to Hotmail for the message
Yes, Bob could. If this email Bob wrote is still saved in Hotmails system in connection to Bobs personal data (in this case their email address in the "from" field clearly identifying it as valid personal data).
(provided it is in fact still) held by Hotmail in Alice's inbox?
Again, you are assuming Hotmails data structure is an exact copy of your user interface. I can guarantee you, it is not. Whether it is visible in Alice's inbox is not relevant here. The only relevant point is whether PII was saved. It was, so an SAR should be able to retrieve it. Even if the email is no longer visible in either persons inbox, if it is still held in Hotmails database, it is subject to an SAR.
So with the SAR, no data about Alice would be given out. As the sender (or even receiver) of the mail, you already know it's contents, and you will only get to know whether hotmail still holds a copy of it. That says nothing about whether Alice read it, deleted it, printed it out and put it on display. Anything. It doesn't even say if Hotmail ever delivered it to her or if their email address even exists at Hotmail. Privacy of Alice is not breached here.
Or suppose Charlotte emails Dave, who uses a different email provider from him. Could she submit an SAR to Dave’s email provider for the message she sent to him, provided it is held by them?
Yes, she could. Assuming she can prove that the PII (email address in the "from" field) is hers, she should get that email as a reply to the SAR.
Now, these were the clear cut cases. Where obvious PII in a field to hold that PII was concerned. It does get muddier down the road. What if Alice forwards the mail, and her mail program puts Bob's original sender email in the emails message text like "forwarded from [email protected]:". Is that still PII? It certainly still is Bob's email address that identifies Bob. But it is not in a field that identifies it as an email address to Hotmail. Hotmail is not required to search their customers non-PII fields (so any field that the provider did not ask for PII and is not using for purposes that would make it obvious they expect PII, for example "favorite pizza toping" or "message text") for accidential PII insertion. A SAR is about what Hotmail knows about you, not what Alice or the person she forwards this information too, knows about you. To Hotmail, this is message text. Could it potentially contain PII? Sure. Literally anything could. Do they know it does? No. That is what counts.
Lets take an example here. 1673. That is a random number I just typed. By the nature of 4 digit numbers only being available for 10000 unique instances, I can practially guarantee you that this is somebodies credit card PIN. So is it PII? If I enter it into a field where the data holder knows it's a credit card PIN, sure. Right now, in this post? No. Even if someone reads this post and goes "what, wait, how did they know my PIN?!?" It's not PII. It's just a number. Only the accompanying information that this number indeed is somebodies PIN would make it PII.
A good example of this might be Facebook or other invasive no-privacy corporate entities. If they do parse message texts, and they do have a table that says "this message from Alice contained Bob's email address" then that could be part of an SAR. I guess a judge would have to decide where Alice's rights to privacy end and Bob's start to take priority. My personal guess is that if Alice agreed to have her data spyed on this way by their message service, they would side with Bob, who is not even a party to that contract and had his PII taken and saved without his consent.
