Michael Gesmann told me that our approach to only have usernames in audit logs is not sufficiant for GDPR law. So for legal reason we need to have a method to remove usernames from (and user ID?) from the audit logs on user request. Michael also s...