One use case that I think is not sufficiently considered in this is related to two comments I made about a year ago [0, 1]. If you can _actually_ delete someth

One use case that I think is not sufficiently considered in this is related to two comments I made about a year ago [0, 1]. If you can _actually_ delete something, then that means that a malicious actor can fabricate data an claim that you deleted it. GDPR may be well intentioned but systems that have the ability to remove any record of a thing lay the groundwork for systematic fabrication of data, because any record of the past has been erased. Operationally, I can totally see why soft delete might be considered to be problematic in certain cases, but from an information security point of view I think it is absolutely critic for protecting users against a whole class of attacks. 0. https://news.ycombinator.com/item?id=27249738 https://news.ycombinator.com/item?id=27249738 1. https://news.ycombinator.com/item?id=27691442 https://news.ycombinator.com/item?id=27691442