Hi @Astrokeith,
Unfortunately, the flexibility that IMAP provides in allowing access to a Master Source of data via multiple devices, each of which updates and reflects the single state once synched, is also a weak point, given the IMAP server is a Single Point of Failure. Hence the reason many on this board have urged people to regularly make back-ups; something I believe VM should be much more up-front and forthright in highlighting…
So, technically, VM have not deleted data on customers’ machines/devices – those devices have simply synchronised with the Server, and now reflect the void that exists there.
VM’s actual legal obligations lie in the UKs GDPR regulations wrt ensuring User Data held on its servers are secure, and readily available by means of ‘appropriate technical and organisational measures’ – this is the ICO’s ‘security principle’.