Do you have a citation for this? It conflicts with what I know about GDPR.
Mostly GDPR encourages companies to delete personal data they were holding once they no longer have a legitimate use for it. There is a rule where you can demand your data be frozen if so that misuse cam be investigated and in that case you’d be right. But in general companies can and should delete personal data.