I am a member in an association and in charge of membership management and general IT. We exchange information about the work of the association by email using private mailing lists the association maintains.
John Doe was a member for five years and requested to terminate his membership in due time by the end of last year.
Three years ago a beautification action of the clubhouse took place, on which Doe had helped and therefore had written over the mailing list: "I help with and come around 3 o'clock!" (message 1). Another member emailed to the team: "Just ask John, he has the type of drill that we need for the repair of the clubhouse" (message 2).
Doe now asks to delete his personal data associated with his membership according to the GDPR. We removed him from the list of members and from our management software, and have deleted his email account. He is no longer subscribed on any mailing list.
But do we have to go further and erase every reference to his name in normal email correspondence? That would be very difficult for us, because his name may or may not be mentioned in other communication where his name might be referenced as in the example above, which may contain other information important for the associations activities.
So how do we have to deal with existing content containing personal data stored in email listserver archives or in personal email folders of staff members?