Let's look at the following scenario: institution X holds a webinar, and after it is finished sends a follow-up email to all the participants leaking their email addresses in the CC field of the email message.
After that, I receive a new email saying that the data is leaked and they want each one of the participants delete that particular previous email.
After one more day, they ask for the confirmation that the participants deleted the email.
Is there any legal way institution X could enforce the participants of the webinar delete that particular email? What happens if a participant does not delete it? What if they save it first in a file and deletes the email? Is such a confirmation really needed/mandatory?
If it helps, we could consider the European Union as the place where this happened, but I would be interested what would be the case in the United States.