> I was able to ask my PhD college, and several other institutions, to see all emails in which my name appeared in either the subject line or the body of the email Hmm, I don't think I like this, and I don't understand how the GDPR allows you to do this. While I understand that stored emails that mention you are technically "data about you", I wouldn't consider them "your data". Emails are a form of personal communic…
It's squarely within the spirit of data protection as well. Are those emails data? Yes. Do they relate to you? Yes. Are they being used to make decisions which affect your employment? Also yes.
Redacting the PII of others in the same emails is an extremely tricky problem though.
The lesson of this and other things like the LIBOR chatroom has to be "don't conspire against people on your employer's computer systems".
There is a flip side to blacklisting; one of the things that has emerged from the #metoo era is that many institutions had staff who were "missing stairs" - they were widely known to harass female staff, and the whisper networks propagated this, and even in some cases the male staff were aware that they shouldn't leave X alone with a female staff member, but no action was taken.
GRPR forces institutions to be open with their disciplinary processes. You can't "shadowban" staff, unless you're willing to do it entirely verbally without ever committing to email.