My question, as always in these cases, is what guarantees are there that this data is actually deleted?
Maybe I'm just old but... look, somebody owns the drives. "No longer visible in the public interface" isn't "deleted", somebody always owns the drives, somebody was responsible for disaster-recovery and backups, somebody was testing against a db clone on a developer machine. There is always somebody doing all of these things.
Deleting data is hard now, for real.
