I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes: > Whether da

I'm responding here because we've hit the limit on the other comment stream, but I truly want you to better informed on this subject so here goes: > Whether data is an image or some other record is immaterial. This is wildly inaccurate. The content of the data is extremely important in determining how to properly store and (potentially) dispose of it. If the data contains PII, or is covered under PCI or HIPAA the processes are entirely different. Even under GDPR erasure requests there is specific guidelines for determining what types data should be deleted and for what data should be "vaulted" (aka soft-delete) rather than hard-deleted. Yes, even under GDPR the regulations say to soft-delete. > If the user tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. This is, maybe, a good goal for us to set as an industry but let's be perfectly clear - this is not a reflection of reality today and at it's core, this is my only point. I'm not aware of any fines for not hard-deleting a single piece of data but always ready to be more informed here, please shoot me that source. That said, besides the technical challenges of actually deleting the data (which I agree are not a reason or an excuse to not delete it, and the GDPR does a great job of outlining this) there are myriad reasons to keep it around. There's a reason MacOS has Trash and Windows has a Recycle Bin, and a few dozen tools in existence for recovering data even once they've been deleted from those places. Many of these use cases are actually beneficial to the user. "Undelete" is a real thing that users expect to be available (often for good reason)...and this is impossible after writing zeros. Data deletion is a very nuanced subject and treating it as black and white does no one any good. > Whether your company is based in the USA or not is immaterial. Again, incorrect. The regulatory body in effect is extremely material. I mentioned USA because those are the rules I am most familiar with.