Can you report that to the privacy regulator in your European country? The "mark as deleted" versus actual deletion is an important distinction. I can't do anything as a non-European...
I was planning on looking into how to best document it the next time it happens, and whom exactly to report it to (i.e. the national or European data protection authority). Not sure if there is anything else I could do.