The real dilemma is that as a service, you can't do it right. If you keep the data around and just mark it as deleted, the EFF will post articles about you violating the users rights for privacy and control of their data.
And if you delete the data, then $publication will write articles about you being unable to restore it.
Take the Facebook "account disable" feature as an example. In the context of this article here, it was sold as a "good" feature (so as something that Flickr should have too).
But this exact same feature was all over the press a year ago as something really bad and just showing how Facebook just doesn't want to let you go.
So. What is it now?
Personally, just flagging for deleted and living with the privacy concerns might be the better option because there are potentially more people deleting data by accident (or have it accidentally deleted) than there are people too concerned about privacy to use the service.
Also, users concerned about privacy just won't be users whereas users who just lost their data were users and now aren't, so that's a net loss compared to the users not joining.
And if you delete the data, then $publication will write articles about you being unable to restore it.
Take the Facebook "account disable" feature as an example. In the context of this article here, it was sold as a "good" feature (so as something that Flickr should have too).
But this exact same feature was all over the press a year ago as something really bad and just showing how Facebook just doesn't want to let you go.
So. What is it now?
Personally, just flagging for deleted and living with the privacy concerns might be the better option because there are potentially more people deleting data by accident (or have it accidentally deleted) than there are people too concerned about privacy to use the service.
Also, users concerned about privacy just won't be users whereas users who just lost their data were users and now aren't, so that's a net loss compared to the users not joining.