Wait, I think I'm starting to see what happened, correct me if I'm wrong. 1. Someone requested you delete their data from your system. 2. You did this and log

Wait, I think I'm starting to see what happened, correct me if I'm wrong. 1. Someone requested you delete their data from your system. 2. You did this and logged their request. That seems legit and pretty much un-jerk like. How did the user know what data you held on them? If they didn't know then the fact that you only held an email address then asking you to delete seems reasonable. Also, did you really only have their name and email? Unless you have a table called "names_and_emails" that isn't linked anywhere else I assume that you've got the user linked to some sort of subscription or something? That's information too. The other possible meaning of what you wrote (and my first understanding) was that the same user sent two deletion requests. That does seem excessive, but then if you complied with the first then the second just becomes a formality at that point surely? > Does doing that preclude criticizing the clumsy legislation that caused this? Wether you think this law is clumsy or not (I don't, I think it's a hell of an improvement on the status quo) it stands a good chance of protecting people's privacy, and as a father that is especially important to me with kids growing up even more intertwined in digital age than I was. As someone who runs a few sites it means some more work for me, but it's worth it. I'm still a person in the world with the need for privacy.