"the right to be forgotten" This is already in EU data protection law where data needs to be forgotten after its relevancy and a cool down period, it considers

"the right to be forgotten" This is already in EU data protection law where data needs to be forgotten after its relevancy and a cool down period, it considers and covers things like your example. "purge the data from your backups" Again you should already be doing this if you do business with the EU or you are breaking the law. "Do you have the ability to retrieve everything you know about a specific user" Again this is already in the EU data protection law you should already be able to do this or you have been breaking the law. Im not a lawyer so take this all with a pinch of salt this is just stuff I need to know as an EU developer. Sure it might be slightly more work for US tech companies but I can't be arsed is not a valid reason to break the law. If you think it will cost to much then don't do it, there are plenty of EU companies that do.