It's been EU law for a while that a company must delete all user data upon request.