[Dylan16807]

>It's quite clear what happened.

>There is nothing to "track".

From the article: Goldman (GS.N) [...] wants Google's (GOOGL.O) help in tracking down who might have accessed the data.

>from a private user's account without their permission

I think you're focusing too much on technical details. An email sitting on the server unread is effectively still undelivered. GS wants to cancel delivery. I see that as fair and not intrusive.

>the likelyhood the gmail account owner noticed the email

It might not have even been an active account.

>we can assume the data is already in the open.

Why in the world should that be assumed instead of checked?

[Alupis]

> Why in the world should that be assumed instead of checked?

Because email is not encrypted and not secure... so any server or anybody in between GS and the google server that data wound up on, could have a copy or seen a copy.

Not to mention all the possible ways this data could be exposed. The receiver took a picture. Printed it. Saved to a file. Forwarded it and it was forwarded again. Not every device marks emails as "read" on the server. The point is, Google can't tell GS if this data is secure or not. Deleting the email is irrelevant at this point.

You are forced to assume it has been exposed because the data left your premise and your control.

[Dylan16807]

Most email these days is sent via TLS. Google could check if it was.

Of course they wouldn't just check if the email was marked as read, but the server very likely knows if the email (or the attachment if it was one?) has been accessed at all.