[stubish]

It is everyone. For instance, in my role as DBA over 15 years ago we went ahead with a relational data model without much thought about 'how do I delete a user'. A few years later, I needed to write a script to scrub a user from the complex schema. Dozens of special cases 'how do we repair the data if we remove this row or alter this foreign key', cascading, and trawling the foreign key definitions in the database schema to write tests to automatically pick up when the schema was changed and fail integration tests if the script wasn't updated to cope... great fun writing that horror, but slow and should never have needed to exist with a bit of forethought. To this day removing an account is a slow, asynchronous process. And now with GDPR nobody should make that sort of mistake again since they should be aware.

[c1ll1an]

Commendable work @Stubish on writing that script. You've nailed the exact problem that I'm referring to here.

Strong privacy is a kind of anachronistic issue in that the regulations came long after many systems were designed/built but also most of the common methods used to continue to design systems. So consistent data deletion across distributed system should be easy, but of course in truth as you know, it's a nightmare and often a brittle solution that needs to be updated as your software continues to change.

This specific example you've taken is a really good one of how painful privacy can be and how avoidable this issue should be for all devs, both software and data teams.