> And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitel

> And if you use a deduplicating backup system -- and you may have few viable alternatives at small scale -- the answer to that latter part will be "indefinitely". So yes, the GDPR does effectively ban backups, at least in this sort of scenario. If the blocks are deduplicated because the reference count of the bit map remains greater than one then I don't see the problem: Just because John Smith can ask you to delete him from your database doesn't mean he can ask you to delete all John Smiths. Also: European courts aren't amused by this kind of nonsense. > And yet there is nothing else you can reasonably do in the absence of more specific, enduring and legally binding guidance from your national regulator, and even that guidance is at risk of being overturned in court at European level. Sure you can. You can look to the historical application of various other similar laws and get an idea of what the regulators are likely to do. For what it's worth: European courts cannot be legally bound to do anything. If they think you're being an asshole but are "technically within the law" they'll still fine you. That's just how it works here: Hurting people is simply not ok. > Nope, because the right to erasure is not negated because of those sorts of common sense It's not "common sense" at all: Being afraid of the government and the police isn't something civilised countries have to deal with. Why would anyone think that the government is trying to hurt people if everyone agrees hurting people is not okay?