It doesn't matter if Anna "owns" the data; The GDPR doesn't care who owns data. What matters is who controls it and what processing they do on it (with storage considered processing).
Side note: I know someone who requested their data to their DPA, and part of the response contained emails mentioning them and their complaints in the _content_ of the message (they were not in the From:, To:, Cc:, or Cci: fields). All names and emails address were censored, though, in accordance with 15(4).