HN may cite legitimate business interest and not oblige in deletion.

A more extreme example can be that when you perform a deletion, do you also deep delete from logs and backups of logs? What if you need to keep them for audit and forensic purposes?

Edit: citing legitimate business interest does not necessarily mean it will succeed. Courts will have the final say. EU likely will not enforce smaller entities so soon. We may need to see a few court decisions or better guidelines before we get a better idea how to navigate through GDPR.