If this wasn't too long ago you should report the case to the AP since it was likely illegal even before gdpr was a thing. Depending on how the email was offere

If this wasn't too long ago you should report the case to the AP since it was likely illegal even before gdpr was a thing. Depending on how the email was offered this could be a major violation of privacy. Even in commercial employer/employee instances you do not have a carte blanche and in cases of students it's even more murky especially if it was done without adult consent.