Another GDPR question - as part of our data retention policy, I'm required to build a process which marks users who haven't logged in for more than [X] years as inactive, and change their usernames and emails to "obfuscatedUser[firstname.lastname@example.org".
Obviously this causes an issue for changing the email address - it requires confirmation from the new email address. However, if you're changing the address on an inactive user, and you're changing it to an email address that doesn't exist, you find yourself in a bit of a pickle.
There's the option of switching off verification altogether, but this is a whole lot of hoops to jump through and we do want to keep verification on in most cases.
Does anyone know of any alternatives? How are we going to manage GDPR Right-To-Be-Forgotten regulations if we can't obfuscate the email address of a customer who wants their details taken off our system?