To what extent is this, or will this be enforceable? Is there an obligation to securely erase data? If not, presumably someone could store user data on a log-st

To what extent is this, or will this be enforceable? Is there an obligation to securely erase data? If not, presumably someone could store user data on a log-structured file-system and disable garbage collection, or similar.