But not this way, not forcing all of your users into a public profile by default and making them provide gvmt ids to delete their accounts. Your users gave you their data for a specific purpose, and you took it and used it totally differently. This seems like a great violation of GDPR BTW.
AFAIK unlike the CCPA, there's no private right of action for the GDPR. That is to say, you can't actually sue the violators yourself, you need to complain to your country's national data protection authority, and they have to take action.