and
> allowing people to request removing them are a bridge to far.
Are dissonant. You will have to pick the one or the other but you can't both care about privacy and not allow people to request removal of their data. That should be fairly obvious.