EU already has this with the GDPR. Only limitation are retention periods required by law, like employee data needs to be kept for ten years in Germany for example, but for the duration whoever has the data must block it from being processed for anything but the legal requirment, as that becomes the legal basis for processing (storing in this case) and no other uses are allowed until deletion.

Only applies to EU citizens though plenty companies have implemented straightforward ways to delete an account for everyone.