A customer in the EU submits a formal request to an online retailer, demanding that all of their personal data be permanently erased from the company's systems. The privacy team confirms there is no ongoing legal or contractual obligation to retain the data. Which privacy principle obligates the company to honor this request?