Email (record): Does the CMA's privacy code go too far? Or far enough?