I think there’s some „reasonable” keyword in the right to be forgotten. Like first if you have some old backups on tapes and you must keep them for whatever reason still for few years m, you can deny altering them if it the cost would be exorbitant and you ensure the users won’t come back after a recovery from said backup.
Also they might train their models on pseudo-anonymized dataset so as long it’s too expensive to deanonymize the user data it could be fine in terms of GDPR.
For example: you generate car trips stats per city in a country, per day. You could argue that you don’t need to delete user data that is part of this set if you ensure there are always enough of trips recorded (so can’t deanonymise someone from a single entry) and also it would falsify your historical stats.
At my company who likes to be super compliant we do remove people from this kind of stats using some pseudo-anonymous references. So if you remove your account, there’s an event that changes the historical analytics data and removes all traces of your activity. But that’s because we can and want to be cool (company culture principles).
Other data we have (website analytics) are impossible to go into this process as we ensure we never know WHO did something. We only know what and when.
a_wild_mimic_appears@lemmy.dbzer0.com 4 hours ago
a quick overview of the legal battles of Max Schrems / NOYB: en.wikipedia.org/wiki/Max_Schrems