I suspect GDPR would have been sufficient threat since not all people involved in a scanned email were guaranteed to be Gmail users, so gaining consent would have been problematic.