There is a restriction though, its either all or nothing. You cannot choose which part has to be removed. And if the company has a good reason to keep the data (for example, if your account was banned due to cheating, and your phone number is tied to it), the GDPR will not help you.
Im not entirely sure though, since even in the GDPR, they technicaly dont have to entirely remove your data. They can put it on an offline storage system, and its going to be considered a valid response. I can imagine for US citizens being a similar system.
The GDPR is made so you can keep yourself anonymous on the internet, and remove any negative result from earlier actions (a bad forum post or whatever), but the company is still allowed to be able to detect whether you were a previous customer (and refuse to help you because of abusive actions).
The GDPR also doesnt cover situations in which you reached the news or became well known because you are a celebrity or developer. If something is still considered relevant, they are allowed to keep the information online.
In old news articles, you for example cannot actualy get your name removed (although in most cases it has to be obscured a little anyway so you get a name like J. Doe, or John D., and this doesnt require the GDPR for that). And in the case of hots, it means a HGC player cannot get his info removed, those players are too well known in this case.
There is another side effect though, if a company is split up, (for example facebook and whatsapp). They are sometimes considered diffirent entities. The GDPR allows you to remove all facebook info, while keeping whatsapp untouched, even though its still both just facebook. That is because they are seperated services and do not rely on each other to work.
Even if facebook would decide to merge them together (they are explicitely disallowed to do so! it was one of the conditions that was set when facebook purchased whatsapp), the GDRP allows you to target only the facebook, or whatsapp website.
Its the same with for example counter strike on a console. Your counter strike info can be removed, but your steam account can be preserved, even if they are connected. Its considered a completely diffirent service, and therefor targeted seperately in the GDPR. But you can still target both services in a single request (if you want both your account and game info removed).
The GDPR is ment to be easily usable for citizens, and does not allow companies to indirectly create conflicts just to anoy you. It can obviously happen, but in that case its down to the company to solve this, if they do not solve this, they are not obeying the GDPR request as they should (technical limitations can happen, and sometimes require a workaround, but that usualy only happens when you discover the issue after 2 years, in which case the GDPR would state the company did the task well enough).
This is why it sometimes appears as a mess, but it was deliberately made that way. If an issue rises, the company can generaly pass this request to the EU which then decides the proper action. Again: customers are not the ones that have to start any expensive lawsuit or whatever, as that would make the GDPR ineffective. Unless the EU decided that the company did his job well. As in that case you have to appeal it to the EU. And if the issue is true, its often not going to be a lone citizen to appeal this. And that remains a costly thing to do.
Its because its easier to seperate it like that, its going to give the least conflicts to the GDPR, is much easier to code (not a lot of special conditions are required), and makes it feel customer oriented. Steam has this part well done, often better than what is required.
But note, there are a few exceptions on what it can delete:
- Tf2 items can be traded, as it has a money value, this data can be stored and might not get removed at all. Blindly removing those can cause issues. Its very likely only going to be the untradable/unmarketable items that are going to be removed.
- If you made a tf2 map, and its in the workshop, your data will still be connected to that. And this is a permanent connection (you agreed on this when uploading items to the workshop). The workshop might make the item unreachable, but anyone using the item and discovering something that would be illegal in that item, would still make it backtrack to you.
So yes, even the most simplest looking thing can actualy be a bit more complex. And thats why its very likely on a per game basis.