Technically very smart solution, but legally way too risky.
If there's ever a breach, for example someone steals the key and then accesses the data, the fine will be super high given that the company has retrained data after the user asked to delete it.
To mitigate such risk, the company would at least need explicit consent of the user, at which point it's just as simply asking the user to not really delete their account.
A viable option, legally speaking, could be to send the dump to the user, in a way that can be easily imported back if the user ever wants to login again.
If there's ever a breach, for example someone steals the key and then accesses the data, the fine will be super high given that the company has retrained data after the user asked to delete it.
To mitigate such risk, the company would at least need explicit consent of the user, at which point it's just as simply asking the user to not really delete their account.
A viable option, legally speaking, could be to send the dump to the user, in a way that can be easily imported back if the user ever wants to login again.