As of fall 2015, the "International Safe Harbor Privacy Principles" are no longer sufficient in Europe. New regulations, written by the Article 29 Data Protection Working Party, came out in spring 2016 and information on this group, including regulatory text, can be found here.
On their site, the page "Protecting your data: your rights" states that users can ask several things of "persons or entities which collect your personal data" including:
- You have the right to ask for the deletion, blocking or erasing of the data.
On a page listing obligations of those who collect personal data, it says:
- Data controllers must ensure that data subjects can rectify, remove or block incorrect data about themselves.
- Data that identifies individuals (personal data) must not be kept any longer than strictly necessary.
In the documents section, their January 2016 Fact Sheet titled "How does the data protection reform strengthen citizens' rights?" states:
If you no longer want your personal data to be processed, and there is no legitimate reason for a company to keep it, the data shall be deleted.
For the reasons listed above, I conclude that in most cases, you should accept and comply with user requests for account deletion. There are likely exceptions, such as if you and the user have some active dispute and the data stored in the account would be evidence in resolving that dispute, but hopefully that is a small minority of account deletion requests.