> they just don't need the data anymore.

Thats the wording of GDPR.. that you should delete data after you dont need it anymore for the original purpose..

Unfortunately, it seems noone is enforcing it enough.