I am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.
Undoing personal information for a purpose different than the purpose for which it was collected.
Undoing personal information for a purpose different than the purpose for which it was collected.