The GDPR gives users the right to have their stored data deleted.
How does the GDPR handle situations where the data controller needs the data to fulfil their obligations to users (specifically by allowing a software to function)?
Assume a software ("aggregator") that aggregates and displays information from a social network, to provide a more useful dashboard and notifications than what's built into the platform.
Users of the social network authorize the aggregator to access, store and display their friends' activity, and the service then notifies them when something interesting happens. This would make the aggregator (more precisely, the entity behind it) a "data controller" under the GDPR, right?.
Now if a user's friend requests deletion of their data from the aggregator, can the aggregator claim a "legitimate interest" reason to not delete that data? Since omitting friend activity from users' dashboards/notifications would mean not fulfilling the contractual obligation to the aggregator's users.
As a compromise, would it be permissible to substitute deleted information with anonymous records, like "An anonymous user commented in your discussion", given a user can trivially reference the discussion on the original platform and identify this "anonymous" user?