1. Nothing is ever absolutely safe. Everything can leak at some point or another be it only because someone whipped their phone out and took a picture of the screen.
2. Just because it can not be made 100% safe, doesn't mean no efforts should be undertaken to push things in that direction.
3. Despite being well-spirited, DGPR is a retarded piece of legislation. Bested only by the EU cookie law.
Why? As someone (currently) in the EU I'm quite happy with it.
This is like somebody calling for a law that bans all cars, someone else calling that retarded, and you coming along and saying Why exactly is it retarded not to drive on the pavements? That's what roads are for!
"the CC feature in itself might be a GDPR violation" is a, to use your words, "retarded" idea. For starters you can still send emails internally, perfectly fine to use CC there. Also I'm sure there are some legitimate interest cases where CC instead of BCC makes sense too.
This is classic GDPR fear mongering and laziness.
Well, yes, I agree.
> This is classic GDPR fear mongering
Well, no. The person who suggested that it's a violation is anti-email, not anti-GDPR; it's implicit that they think it would be a good thing if the CC feature were inherently illegal.