The law on sharing an archive
Can you sell company emails? The law on passing mail on
Updated
Owning the mail is the first test. The second is what the law says about the people writing it and the services carrying it, and it differs between a trading company and one in insolvency.
Stored communications in the US
Section 2702 of the Stored Communications Act limits when a provider of a communication service may divulge what it stores, and one of its exceptions is disclosure with the lawful consent of the originator or an addressee or intended recipient. The Wiretap Act allows interception where one party to the communication has given prior consent.
Source: 18 U.S.C. 2702 (Cornell LII)
Personal data in the UK
UK GDPR article 6 allows processing only on a lawful basis, and article 5 keeps personal data identifiable for no longer than its purpose needs. The Data Protection Act 2018 makes it an offence to obtain or disclose personal data knowingly or recklessly without the controller's consent.
Source: UK GDPR, art. 6
When the company is in insolvency
In a US bankruptcy a trustee may not sell personally identifiable information against the debtor's own privacy policy unless a consumer privacy ombudsman is appointed and the court approves. A UK administrator has the power to sell the company's property by public auction or private contract.
Source: 11 U.S.C. 363 (Cornell LII)
Read next
The periods the mail must still be kept for are on how long business emails should be kept, and the buyers on who buys company email data.