Deletion Requests, a Legal Hold, and an Untraceable Model
Northwind Health received bulk deletion requests from 5,000 account holders on 3 March. The statutory window closes 30 days later and 12 days have already elapsed. The event warehouse holds three years of behavioural data for those users, joined to session-level tables rebuilt nightly. A litigation hold covers 120 of the 5,000 accounts because of an open billing dispute, and in-house counsel has not confirmed the hold's scope in writing. Backups are immutable for 35 days and cannot be selectively edited. A churn-prediction model trained last quarter used the full dataset, and its training manifest does not record which user IDs contributed to which model version. Two of the three engineers who understand the deletion pipeline are on leave until day 20.
1. Sequence the work and identify the critical path. What do you start today, given that two of three pipeline engineers are unavailable?
Read the worked answer
The trap is treating this as one task. It is four tasks with different owners and different blockers.
Sequence:
- Today - freeze the input, not the output. Suspend the nightly rebuild's inclusion of the 5,000 IDs so the dataset stops growing while you build the deletion path. This is a filter change, not a deletion, and it is the single highest-leverage move available.
- Today - get the hold scope in writing. Counsel's confirmation is a hard blocker on 120 records and has a multi-day turnaround that starts only when you ask.
- Day 13–19 - build and dry-run the deletion against a staging copy using the remaining engineer plus one borrowed engineer who documents as they go.
- Day 20+ - execute when the pipeline specialists return, leaving roughly 10 days of buffer.
- Backups - document, do not attempt. Immutable 35-day retention means the deletion propagates by expiry, not by edit. Record the expiry date as the compliance answer.
Critical path: counsel's written scope, because it gates record selection and has the least controllable lead time. Everything else can be parallelized or staffed around.
Judgement point: the borrowed-engineer decision is deliberate - a single-person dependency on day 20 is the second-largest risk in the plan.
2. The model's training manifest cannot say which user IDs contributed to which version. Decide whether to retrain, retract, or document - and justify the choice.
Read the worked answer
Neither retract nor retrain blindly. Choose retrain, but on a schedule that does not block the deletion.
Why retraction is disproportionate: retracting a churn model removes a business capability with real cost, and the manifest gap means you cannot demonstrate harm - you also cannot demonstrate its absence. Acting on an unproven worst case is not more compliant, just more expensive.
Why documentation alone is insufficient: "we do not know" is not a defensible retention position if a regulator asks which personal data persists in model artifacts. It is a known gap with no remediation date attached.
Why retrain: it is the only option that produces a clean, provable provenance record going forward. Run it after the deletion executes, so the new model is trained on data that already excludes the 5,000 IDs. This makes the deletion meaningful rather than cosmetic, and it converts the manifest gap from permanent to historical.
Conditions that would change this:
- If counsel determines model weights constitute personal data under the applicable regime, the retrain moves ahead of the deletion and the current model is pulled from serving.
- If retraining is infeasible before day 30, ship the documented-gap position with a named owner and a dated remediation commitment, not an open-ended one.
Disclose the gap upward now. Discovering it in a later audit without a prior record is the outcome that causes real damage.
3. How do you handle the 120 accounts under litigation hold without stalling the other 4,880 deletions?
Read the worked answer
Split the population and proceed on the uncontested majority.
Mechanics:
- Partition the 5,000 into a 4,880 deletion set and a 120 held set. Execute the 4,880 on the original schedule.
- For the 120, apply suppression rather than deletion: exclude them from active processing, analytics, and model training, but retain the underlying records pending counsel. Suppression is reversible, satisfies the preservation duty, and stops ongoing use.
- Log the partition decision, the date, and the authority relied on, before executing.
The judgement call people get wrong: waiting for counsel to clarify all 5,000. A hold on 120 accounts does not license inaction on the other 4,880, and the statutory clock does not pause because one subset is contested.
Boundary condition: if the hold's scope plausibly extends beyond the 120 - for example to a shared account hierarchy or a firm-wide billing system - the partition must be re-examined before execution. That is precisely why written scope is worth escalating for rather than assuming.
Escalation if counsel does not respond by day 18: escalate to the privacy officer with the statutory deadline and the risk of non-compliance stated in days, not in principle.