GDPR introduces a new right to be forgotten, and I no longer consent to Google keeping my data for the sole purpose of maintaining a ban. (Google is keeping my data in order to enforce their ban on my account.)
P.S. Every year hundreds of thousands of users are banned by Google based on automated checks. Here a Google employee confirms they banned over 200 000 thousand accounts alone in 2015.
The GDPR's right to erasure is not absolute. Simplifying things a bit, you only have this right if
Legitimate interest always requires that the controller's legitimate interest and the data subject's rights and interests are balanced. A request for erasure shifts this balance but does not decide it.
In practice, a request for erasure may be denied if
Note that contracts may have effects that survive termination of the contract. Note also that a contract might not involve the data subject as a party to the contract, the classic example being a postal delivery contract that necessarily requires processing of the recipient's personal data.
In your specific example it seems that the legal basis was legitimate interest and that the data controller has an overwhelming legitimate interest to hold on to parts of your data for the purpose of fraud prevention.
If you feel like the continued processing of the data is illegal, for example because the legitimate interest balancing was done incorrectly, or because the legal basis was consent, then you have the following remedies:
I'll point out that neither of these approaches is likely to work for you, because abuse/fraud prevention appears like a pretty standard case of overwhelming legitimate interest.
