I'd consider keeping the other personal data to be still easily justifiable, as you might want to support various account recovery options. And the odds that a

I'd consider keeping the other personal data to be still easily justifiable, as you might want to support various account recovery options. And the odds that a user forgot their password only increases for old accounts.