The General Data Protection Regulation (GDPR) gives individuals the right to ask for their data to be deleted and organisations do have an obligation to do so, except in the following cases:
- the personal data your company/organisation holds is needed to exercise the right of freedom of expression;
- there is a legal obligation to keep that data;
- for reasons of public interest (for example public health, scientific, statistical or historical research purposes).
It’s also worth giving them the benefit of a doubt. It might be just a bug or an oversight.
I don’t see how player data even would be worth risking GDPR fines. But at least you don’t have to worry about it.