> Paragraphs 1 and 2 shall not apply to the extent that processing is necessary... for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject...
A criminal in the EU can't go issue a "right to be forgotten" request to the prison system, for example. They have a legitimate reason to decline it.
This is a complete misunderstanding of GDPR, which carves out common-sense limitations for exactly this sort of scenario.
https://gdpr-info.eu/art-17-gdpr/
> Paragraphs 1 and 2 shall not apply to the extent that processing is necessary... for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject...
A criminal in the EU can't go issue a "right to be forgotten" request to the prison system, for example. They have a legitimate reason to decline it.