I've been waiting to see some educated thought on this but it's been pretty absent from the coverage I've seen. Specifically also, I'm curious to understand how not deleting information people apparently paid to have deleted fails to constitute fraud... though successfully arguing negligence would be even more interesting for infosec in the software industry long term.