Steps to reproduce the issue

Generate and confirm an information request by user

Note that a super admin will get a private message in Joomla admin, containing the email address (personal information) about a user

Expected result

pffff no idea...

I'm guessing when a GDPR request says delete all personal data, this should include the data in these private messages - after all these are automated messages and could be crafted without personal data, maybe instead of

User phil@phil-taylor.com has confirmed their information request.

it could say

A User has confirmed the information request ##6.

and then this would not be an issue?

There is no real need for personal data to be "leaked" into the private messages of a Super Admin (and further our in unencrypted email to the super admin's mailbox)

Actual result

Personal data about a person is stored in private messages in Joomla database even after a remove request has been made.