The decision of the Data Protection Authority regarding the retention of email metadata might have a severe impact on the cybersecurity strategy of businesses operating in Italy.