He then leaves and I wish to make some of his data: His address, dob, private so that only admins can now view it. The first thing I will do is move him to the Past Members group so that he no longer has access to the site. Can we automatically have the rest of his data made private when his is moved into the past members group or has it to be done individually for each field?

Easiest way to do that is to just block the user as moderators still have access to blocked users profiles on frontend. You can even have a userlist for moderators that shows all blocked users. Another option is to ban the profile and again only moderators can access their profile. The alternative would be altering privacy controls for their profile, tabs, or fields using CB Auto Actions when you change their usergroup but that gets a lot more complicated. Another option I suppose is a Redirect action to redirect away from those users profiles if the viewing user isn't a moderator.

I assume you're changing their usergroup from backend. If that's the case I recommend just changing their tab privacy there are the same time. Otherwise you'll need to configure auto actions to automate that using the below.

Global
Triggers: onAfterUpdateUser
Type: CB Privacy
User: Automatic
Access: Past Members
Action
Mode: Rules
Method: Create
Asset: profile.tab.TAB_ID_HERE
Rules: Private

Be sure to replace TAB_ID_HERE with your actual tabs id. You'll need to make a Rule change for each tab you want changed (use the Add Row button so you can do all this in a single auto action).

The menu link to send an email does not check the access of the email field. It's entirely based off the "Email Handling" parameter in CB > Configuration > General, which if set to "Do Not Display Email" won't display at all.