> You can generate a key for each user on creation and have their data encrypted with it. The problem is NOT that.

This is still debatable, because what if in near future your encryption turns out to be weak and all the personal data become readable again? Things like this... This law was really not thought through.