Earlier quoted context omitted.
If you’re an EU citizen, by law, all data about you is owned by you, and only by you. That includes personal data, but also any intellectual property you create, and is irrevocable (you can sell usage rights, but never the ownership rights). So, yes, they have a legal responsibility to not have that data about you, and you can at any point require any company to delete any and all data they have about you, or created…
Perhaps someone in the EU bears this in mind: https://en.wikipedia.org/wiki/IBM_and_the_Holocaust The 'Final Solution' was facilitated by knowing who everyone was and where they could be found. The technology at that time happened to be the Hollerith Punched Card system.
And the StaSi, with constant surveillance of everyone in East Germany, also is still in collective memory, and another reason why no one wants that much surveillance (although acceptance for surveillance went up since the Berlin attacks, quite a bit, actually).