Earlier quoted context omitted.
Yes in that it has no consideration on when the data was captured or acquired. And there is a trickle down to anyone you have or passed the data onto.
Ok so you should take care of the data you posses now, but if you have shared the data with third party then I guess this is now their business to obey the law? I just don't see how you could possibly be forced to go and police everyone you have ever shared the data with.
In this case user has apparently given, some level of, consent to Cambridge Analytica. I don't know whether that would then make them a data controller in their own right or whether they still be treated as a data processor. If former then user would have to engage directly with CA for right to erasure or FB need to invoke T&C's. If later then it's down to FB T&Cs and then FB would have to inform CA of user invoking right to erasure.
GDPR will a minefield for consumers and organisations for at least another 2 years until we have some case law that backs it all up