Cleaning the Pipes: Defensible Data Deletion