Outright deletion of data, especially anything used in financial calculations, might run afoul of Sarbanes-Oxley in the United States.
I say "might" because it's not exactly spelled out that way in the regulation. Basically, any sort of reports that are used to make financial decisions must be replicable. You have to be able to show an auditor how you came to your numbers. You have to show how the report would have looked at the time it was made, and what data it would have contained.
I could potentially see raw count of users, or counts of users combined with popularity of videos (and growth of popularity across those videos) be a part of plans on how to monetize such a site. If Livecoding.TV had made revenue projections based on some future monetization plan and had started circulating this plan amongst potential investors, it becomes a serious landmine to hard-delete data.
Most places assume this just means "keep backups", but I don't know anyone who is operationally prepared to restore year-old backups of databases and running application code to be able to appease such an auditor. Full compliance is really hard, so I almost always advise people to go for soft-delete instead. There are any number of technical and business reasons why soft-delete is better, too. If this report that a 3rd party registered a new account with the same name just to be able to troll everyone involved turns out to be true, that would be one of those reasons.
That said, that's a completely different issue than privacy compliance. Any sane authorization system should make it easy to de-authorize specific sets of data for everyone. No data request meant to go out into the world should ever lack an authorization check. Given the difficulties of keeping tabs on internal- versus external data, I just generally believe all data requests should come along with an authorization check, regardless of whether or not it's required, because you can't ever really predict what code a jr. programmer is going to reuse some day.