i can imagine intentionally useless UI for this. require the account number to be entered in a particularly stupid format. 12345 -> one TWO 3 four FIVE. add heavy input validation. make the validation give no hint about what is wrong with the input. defer validation as late as possible in the process "processing cancellation request --- something went wrong, we could not match the entered account, name, blood type against our records. please try again". route all requests for cancellation to a particular backend server bathed in cosmic rays.

hopefully there is a regulator to monitor and enforce the new legislation, and it will be treated as an adversarial iterative game, where v2 of the legislation will eliminate some of the more malicious interpretations of how to comply