Actually GDPR is exactly what they're asking to. Possession of personal data that is not required for a service's functionality is illegal under GDPR.

Well unless it was stored with freely given permission of course.

But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.