As everything with GDPR the question is - do you need that data for your operations? E.g. if you need to keep it to inform your infrastructure to not store the data anymore, then yes, you can. If you don't need to keep it, then no.

If you use it to block the user from using your service or punish them in some other way, that might be very problematic in legal sense.