The schmuck can't "turn over" the data and there's no conceivable way to verify that he deleted it, so this scenario just puts the blame on him if any of that data ever leaks and there's nothing he can do about it.

Also, I'm no legalologist, but I don't see how the rights of the bank's customers are being violated. Their agreement with the bank has been severely breached, but that's between them and the bank. Violating the schmuck's fundamental rights to correct someone else's mistake doesn't seem very balanced to me.