Right to erasure is defined in article 17, and note what it says: > the controller, taking account of available technology and the cost of implementation, shal

Right to erasure is defined in article 17, and note what it says: > the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. There is a lot of leeway in that. Depending on your circumstances, you may have an obligation to erase data, and communicate to other controllers you gave the data to, who also have to do the same. But note you can take into account your technology, cost, etc. - you must be reasonable about it (and instruct others to do the same, so the subject doesn't have to ring round all the 100s of spammers trying to datamine them); work with the process and do the best you can. Don't come up with excuses as to why you're going to ignore the data subject's requests. The person who will be invoking this directive against you will be a national of one of the EU member states, and they'll be bringing their information commissioner with them. I seriously doubt they will proceed against you if, technically, you still have some of their data in old backups or keep tombstoned records for a specific amount of time before permanent deletion, but you've made sure that individual's data will never resurface in your system, even if you restore from backups, and you've minimised retention to what you absolutely need. Of course, if you can delete a specific person's data, and they ask you to, and you don't have other legitimate reasons to keep it, you must. Indeed you should delete it even if they don't ask, as soon as it stops being relevant - and you shouldn't go with the plan of "oh but it'll always be relevant, so I'll keep it indefinitely". Event streams? Have the user's client not send the event, or go round purging events, but given you have to check if the user has opted out of processing anyway, you might as well delete the data when you can. Data warehouses? Go through the user's records and overwrite them with randomised junk, and flag them as unusable. > In the ML/AI era Yeah get outta here with that thinking. Also see articles 21 and 22, the right to object to automated decisions. > I do think very little clear material was available for companies who were trying to come into compliance by the time it went into effect. I sympathise somewhat, but it's a regulation for individual states to actually legislate, and you had 2 years! The main thing you had to do was get the general message and not look for loopholes. From what I see, information commissioners have only been going after egregious holdouts, rather than well-meaning companies, especially if they don't have their own certification scheme running.