> The ATS would have some default timeout where candidates who aren't hired get the e-mail to comply with the law.

The sibling concept of this already exists in Europe with GDPR. Companies have to ask you to keep your data (resume, application, etc) beyond a certain timeout, otherwise they must delete it. Because of this, almost everyone uses a talent system.

It seems to work fine? I appreciate knowing they're going to nuke my info, or keep it.