Something like this might have to be done to comply to GDPR. I’m not sure about the details, but I do know a company cannot keep personal information for longer than they need. At some point, I guess that would probably translate to removing old and unused accounts.
Sure, but that isn’t how it works under GDPR. You don’t need to prove the information should be deleted, you need to prove the information must be kept. To give an example, the company I work for deals with long-lived contracts (often 20 years or more), and once they end we are legally allowed to keep the information for about 5 more years. After that we need to remove it.