I know GDPR provides rights for access and portability, but I'm not sure if you have portability rights for content you didn't create (like messages sent to you).