[new_guy]

INAL but if you've kept the personal data - in whatever form - after they've requested it to be deleted, then you're in violation.