They also had 2 years to come up with a way to fix all of that and if they haven’t I don’t think it’s ok for them to be holding that information in the first place. GDPR does give a window for you to remove the data. They could delete the information from the backups over a period of time.