GDPR is pretty clear that a users “right to be forgotten” isn’t absolute and that businesses should be weighing up (and documenting) a users right to privacy against their other legal obligations.
That is literally a disaster. I wonder if this kind of thing is why the EU is crumbling.