1

Let's look at the following scenario: institution X holds a webinar, and after it is finished sends a follow-up email to all the participants leaking their email addresses in the CC field of the email message.

After that, I receive a new email saying that the data is leaked and they want each one of the participants delete that particular previous email.

After one more day, they ask for the confirmation that the participants deleted the email.

Is there any legal way institution X could enforce the participants of the webinar delete that particular email? What happens if a participant does not delete it? What if they save it first in a file and deletes the email? Is such a confirmation really needed/mandatory?

If it helps, we could consider the European Union as the place where this happened, but I would be interested what would be the case in the United States.

Improve this question
2
  • Is such a confirmation really needed/mandatory? I would think that X is following the required steps after a data leak, they are just trying to show "due diligence". If someone (the Data Protection Authority) inquires about this data breach, they can show "we warned everybody who received the list, these are the ones who have answered that they deleted the email and these are the ones who have not." Being proactive about a data breach ensures a way softer stance in case there is a risk of sanctions. – SJuan76 Sep 18 '20 at 8:48
  • 2
    And of course, those e-mails are PII and as such you should not keep them. It is dubious that anybody will bother you if you just keep them in your inbox, but if you use them for anything you can be asked how did you get them, and "because X's mistake" may hurt X but it is not going to protect you. The fact that you received X's request for deletion (and specially if you told them that you deleted the email) can work against you because it would show bad faith. – SJuan76 Sep 18 '20 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.