How much was GDPR specifically a factor?
We've been using GDPR as the floor, not the bar, for player privacy since before it came into force.
GDPR allows you to keep data on individuals as long as you have a legitimate business interest to keep it. I'm not a lawyer, but as far as I know we do have that legitimate business interest to keep player data even of inactive accounts.
We've just decided that we don't keep data around that we know, in good faith, belongs to players that probably won't return. As I mentioned, every email address or account is one more that could potentially be compromised.