> Among other things, it effectively mandates mutable logs It does not. The Right to Erasure is much more restricted than many people seem to realize. If you

> Among other things, it effectively mandates mutable logs It does not. The Right to Erasure is much more restricted than many people seem to realize. If you can articulate an Overriding Legitimate Interest, and find a way to balance that against privacy, then GDPR gives you a pass. While I don't believe it's been tested in court, the general belief is that the Right to Erasure does not mandate deletion from back-ups. It's generally believed that an acceptable practice is to keep a ledger of "forgotten" accounts off to the side (or their hashes or something), and make sure that your restore-from-backup process deletes those from prod after restore. I know that logs aren't back-ups, but the same idea should apply. The issue with compelled censorship may have merit, but I haven't seen a concrete example where I agree that happens. Like I said, the Right to Erasure is more restricted than many realize. But, Europe also ranks the importance of speech rights slightly lower than we do in the States, so it's possible that certain Overriding Legitimate Interest arguments wouldn't fly.