For the first scenario, I see no problem at all with remote wipe, but I do have a problem with the assumption that deliberate destruction of personal data is acceptable, for any reason. What if an employee had some paperwork at home? Would you condone burning their house to destroy it? Is a car bomb appropriate to destroy a briefcase left in a car?
What right does anyone have to destroy other people's property in the course of protecting their own? Would you support game manufacturers like EA being able to remote wipe your computer if they suspected you of running a pirate copy of a game? The RIAA if they suspect you of torrenting?
When you find the example of the company that requires you to purchase a personal phone and sync it with their corporate mail server, you be sure and let us know. Until then, by all means, scream from the rooftops that this feature exists... but don't pretend there's no valid reason for it.
Orrin Hatch: http://news.bbc.co.uk/2/hi/2999780.stm.
but don't pretend there's no valid reason for it.
If my house has been broken into before, there's a "valid reason" for me to install a tripwire that automatically fires a shotgun blast at the intruder. That won't go over well in court, and neither should this.
In most cases there is more than just email, and the line between exchange and personal blurs. How do you remove the exchange data from a contact originating from exchange but updated with Facebook data? What about company restricted WiFi passwords? Attachments saved outside of the mail program?
It's complicated, and when properly used: a last resort.
Edit since I can't reply below: Linking with activesync is optional. The policies are part of the bargain. Your examples either weren't optional (RIAA) or were things you'd choose not to do (EA).