That's illegal under the GDPR and many other privacy laws and is subject to heavy fines if caught. I work in privacy at a large tech company, and we take this stuff extremely seriously.
It took 4 years and a non-profit making lots of noise for a brazen, obvious and malicious GDPR breach to be investigated despite it being plastered on every single website out there (I’m talking about non-compliant consent popups).
To date, the accumulated fine amount over the 4 years and all fined companies is around a billion. Now lookup the profit that just one top adtech vendor makes in a year.
The spirit of the GDPR is great but its enforcement is severely lacking.
I think the system improved the web as a whole for EU with new options for consumers despite.
It is however a risk, too. The drives are encrypted, without power and not even networked but they can still be stolen together with the encryption key from the same building. But then probably you have bigger problems.
This also forces the systems that test the backups to be also offline, which is a huge hassle.
I’m sorry, I didn’t have time to find a good specific reference, so I just linked to the whole document.
I suppose that a technical solution is to encrypt all backups of user data with one key per user. Then you only have to erase that user’s key if necessary.
Source : talked with people who implemented gdpr deletion at some companies.
Also, given that the EU has been taking increasing action against companies for non-compliance, I wouldn't bet on it remaining unchecked forever. In the intermediate term, I'd bet on there being third-party compliance checks and certificates, with companies that don't use such getting more attention.