alt Hacker NewsNo one said backups.
Deletion of the account should be as simple as overwriting a row on a few tables. If they can handle authentication process, disable accounts based on some automated processes, deletion or the process equivalent to it is similarly possible.
Even in case of backups it can easily be done (delete decryption key for this user's row, if you planned your backups right), but even if it isn't (historical backups for example), even the regulator will agree it's fine (BT, dt).
‘A regulator once told one business that it was okay to do one thing’ is very rarely any indication that that same regulator would take the same position for another business in another situation. Let alone that regulators in general will take the same position.