Laurie VossMentioning GDPR in any context is an excellent way to get different people equally confidently telling you that GDPR requires totally opposite things.
You can always make an argument that GDPR requires something because nobody really knows what the fuck GDPR requires, including the lawyers whose job it is to know, and they'll be the first to tell you so.
Psy Chuan 
@seldo actually i know about GDPR.
GDPR does not just relate to PII. Articles 17 and 19 of the GDPR enshrine in law the "right to be forgotten." To quote: "You have the right to have your data erased, without undue delay, by the data controller (...)"
There are of course conditions. The applicable clause here is point 2: "Where you withdraw your consent to the processing and there is no other lawful basis for processing the data." i.e. "if I say delete it."
Source: https://www.dataprotection.ie/en/individuals/know-your-rights/right-erasure-articles-17-19-gdpr
