> And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cas

> And sure it’s not a great look, but keeping someone’s email address around is probably not something governmental agencies should get involved in, in most cases. Why not? They are unwilling or unable to do it without government intervention. I agree that for an honest mistake you don't need the government to step in. But after a year and multiple tries and broken promises, it's not an honest mistake, it's either intentional or gross incompetence. I especially like that they keep stuff despite GDPR to "comply with internal policies and legal obligations". Making up an internal policy has no relevance to GDPR whatsoever (otherwise it would be quite easy "sorry, we have an internal policy to keep all your data forever"). Sounds like they simply don't care about GDPR.