you are 100% correct. one day i found my 5 months old comments on youtube, which i deleted. i expect someone had restored a backup due to some kind of failure. so yeah, 100% breach of GDPR right there. but an individual, that is the product here, cannot do shit about it, that's just a illusion. only government have the power to actually fix this mess.