Discord was fined 800k euros just today for keeping deleted account's data for too long among other things, which is something at least.
Failure to ensure the security of personal data (Article 32 of the GDPR)
At the time of the online investigation, when creating an account on DISCORD, a password of six characters including letters and numbers was accepted.
The restricted committee considered that DISCORD's password management policy was not sufficiently strong and restrictive to ensure the security of users' accounts.
Key section is probably this one: https://gdpr-info.eu/art-32-gdpr/