The BDSG literally has 3 sections that demand hard deletion of data.
This is not something new and surprising, this has been long discussed.
Again, deletion as in an actual destructive process isn't required by any EU regulation.
That’s an interesting interpretation, because when I asked the ULD, they had quite a different interpretation of that.
The data can be deleted or anonymised, and the deletion can also be soft, as long as no one can query your data specifically no one really cares how it's stored.
https://uk.practicallaw.thomsonreuters.com/3-502-4080?transi...
The new EU privacy regulation is the GDPR and it has a data deletion clause but it's not absolute.
There is no EU law that mandates hard deletion of data.
Member states can have stricter laws but the two I am familiar with which are the DPA (U.K.) and BDSG (Germany) also do not mandate it.
There is also no definition of data you've submitted or data that has been collected only consent to store and or process data.