GDPR / Data privacy: What to do with mailboxes of departing personnel?