Delete my data. But tax law says keep the invoice.

transcript

A customer in Germany says: delete all my data. Tax law says: keep every invoice for 10 years.

Her email is on 300 bills, over two years. In four places. Database, warehouse, backups, dashboards. And the café must keep those invoices for 10 years.

The interviewer asks: what do you do? Erasure doesn't override a legal duty to keep records. So keep the invoice. Remove the person.

It only works if it's designed in. Bills never hold the email. A bill holds a customer ref. It points to her record. That record is encrypted with a key just for her.

On erasure, delete her contact data. Then delete her key. Every copy turns unreadable at once. Backups and warehouse too. No rewriting 10 years of bills. That's crypto-shredding.

The interviewer probes. Why a key per customer? Delete a shared key, and you shred everyone.

Before: the ref points to her readable record. After: the bill is unchanged. Still a valid invoice. Its ref points to a record nobody can read. The dashboard shows the same sales.

The café keeps its invoices for the tax office. She is gone. Nobody has to choose between the two laws.

Full breakdown in the lecture.