But feel free to play fast and loose with this and see where it ends up, as far as I'm concerned it can't happen fast enough that regulators crack down on companies that wilfully ignore the law.

The GDPR does not say to 'soft delete', it says to delete, and that you should make every reasonable effort to do so.

The term 'soft delete' does not occur even once in the reference text for the GDPR. That there are valid cases for soft delete may be true but these are not the norm, they are the exceptions. The owner of the data (end user) has agency. If you wilfully ignore their instructions then you are prime game for the regulators. Whether this data is privacy sensitive or not doesn't matter, the only reason you might be allowed to hold on to it is if there is a legal requirement to do so.

Whether the industry as a whole has not caught up with the law - and Square apparently in particular - is a red herring, it should have caught up by now. That companies chose to spend their resources on other things than compliance isn't my problem, but it will be their problem.

If you are familiar with the rules in the United States but not the ones in Europe then why do you tell me how the GDPR works when clearly you have no clue.

Our compliance officer would have a field day auditing you and you are dangerously incompetent to make all these claims in public representing a company that has a lot of business in Europe and plans to do a whole lot more.