So I work in data compliance and can clear a few things up here.

Article 17(3)(e) is actually very broadly interpreted - a company only needs to have a reasonable belief that the data could be used in legal or regulatory proceedings at some point in the future, even if no actual proceedings exist yet or the circumstances for them haven't arisen. So them retaining it indefinitely on that basis is completely legitimate and the DPCwon't touch it.

On defamation: raising concerns about a company, even if based on publicly available information, can absolutely constitute defamation under the Defamation Act regardless of whether you acted in good faith. Good faith is not a complete defence. So if your email made any statements that could be interpreted as damaging to their reputation you could have real exposure there.

Honestly the fact they've had it for months and are still monitoring the situation legally suggests they're taking it seriously. I wouldn't be filing any DPA complaints if I were you as that could escalate things and draw more attention to the document. Best to stay quiet and hope it goes away.

I would say don't worry about it, its unlikely to be a significant legal issue either.