What data restrictions do we have that would prevent $dataCompany from sharing data with other actors? I'm sure a "privacy policy" can do something, but in the end, not really. The FTC doesn't require a privacy policy; they can only enforce one and apply lowball fines for bad behavior.

For example, what laws would prevent me from running a "* As a Service", scanning everything, ranging from copyright violations, spammers, criminal enterprises, and today's bugagboo of terrorism; and forwarding each of those things to the relevant authorities? Can a law protect criminal behavior in cases it is illegal? What responsibilities do you have if you know of criminality?

And specifically talking of emails, unless they are encrypted, they are akin to postcards with the content all in the clear.

(And for your example, I get your sentiment, but I'm guessing they'd have a neural net that triggers on examples of terrorism discussion. And they'd run all messages through it. Not saying I agree with it without a warrant...)