[GDPR] Implement manual control over Right to be Forgotten

[hexylena]

Just need to let users self-delete. This is a post-may-25 goal.

[nsoranzo]

That's a nice goal, but it's also a bit dangerous (if exploited by a cracker) and I'm not sure it's actually required by GDPR. I think we can add an option for the user to request their account deletion, but there should be a vetting by an admin before the user is actually removed.

[hexylena]

Sure, if it was immediate and permanent. But I think there are options there:

• email with a link they must click on
• facebook style soft deletion for N days then permanent with emails reminding you

[hexylena]

xref https://biostar.usegalaxy.org/p/28373/ which was mentioned in chat today.