[Trombone12]

If it's GDPR you're referring to, I think these bits of Article 17 (right to be forgotten) are relevant:

""" Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

...

(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

(e) for the establishment, exercise or defence of legal claims.

"""