Say Anna and Benjamin have email accounts with the same provider.
Anna sends an email to Benjamin.
Anna deletes the email from her outbox.
The provider still knows that Anna sent the email and the content. Because it is still in Benjamin's inbox.
When Anna requests access to everything the provider knows about her - does the provider have to give her the email from Benjamin's inbox?
If an email existed on her mailbox, it would be hers. Once it was out of her email, she would not be able to claim ownership of it.
Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).
And if Benjamin is using their email inbox in a purely personal manner then it'd be out of scope of the GDPR entirely.
https://commission.europa.eu/law/law-topic/data-protection/r...
And Anna's email address is part of the email in Benjamin's inbox.
As a consequence personal data that exists only within the content of an email wouldn’t be considered. Just like free form notes wouldn’t be considered, unless the notes were filled and recorded in a manner that made lookup easy.
Then there’s also other people’s right to privacy. Your right to data doesn’t provide you with a right to intrude into other people privacy. So emails in your account, and records associated with your account are all fair game, but you don’t have a right to reach into other people’s account for data, or a right to force companies to perform super broad searches across every piece of data they have, just in case your name or similar appears in it.
Of course all of these laws have space for interpretation, but that’s why we have courts. They’re ultimate arbiter of edge cases where it’s not clear what the correct cause of action is.
This is wrong - very wrong.
Article 4 defines personal data:
"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"