HackerNews doesn't collect personal data.
Deleting anything someone wants deleted isn't covered
There's an email field in the settings.
And that's the problem: the vast majority of HN posts probably don't include personal information. But if someone were to submit a GDPR deletion request to HN, does HN really want to spend the time auditing perhaps hundreds or thousands of comments in order to determine what has personal information in it and what doesn't? And then also making a judgment as to whether the entire comment would need to be deleted, or if only part of it needed to be redacted? So I'd completely understand if HN would comply by deleting all comments.
(I'm intentionally ignoring the fact that it's unclear if the EU could even enforce the GDPR against HN/YC, as I'm not sure if they have any business entities in the EU. Certainly the GDPR as written tries to be extraterritorial in its demands, but enforcement is another matter. HN/YC are of course subject to the CCPA, though.)
But, for example, consider your post here that I'm replying to: I don't think anyone could credibly claim that it contains personal information. I believe HN will anonymize the username on past comments during account deletion (maybe only if requested, though?), so at least the comment wouldn't be attributed to anyone identifiable. But, of course, if someone posted their real name in a comment, or even just information that could identify them, that would be personal information in the comment body itself.
Frankly I'm not a fan of the idea that comments on a public forum need to be deleted as a result of GDPR deletion requests. It would really suck if clicking on an old HN comment thread meant that you'd see a bunch of "[deleted due to GDPR request]" peppered all over the comment threads. Or think of a site like Stack Overflow: it would be a shame if a GDPR deletion request means that SO has to delete all a user's questions (which others may have spent time and effort answering!) and answers (that others would continue to benefit from reading).
I think in this case the GDPR goes too far in making the site owner responsible. Sure, a site owner should absolutely be responsible for personal information it asks for and intentionally collects, but it seems a bit unfair to extend that to information a user may voluntarily submit, in a context where the submission is free-form and unstructured.
Then again, I'm -- perhaps hypocritically -- of the opinion that sites like Facebook should be required to delete all posts and content when someone wants to delete their account. Back when I used it, I'd definitely run into some old post comments where some comments have been deleted (due to account closures), which really confuses the conversation going on in the comments. For some reason my heart is trying to tell me that FB and HN are somehow different here, even though I can't logically support that. I think my feeling is that stuff I post on HN belongs to the community, whereas stuff I (used to) post on FB still belongs to me. Not sure why there should be that difference, though.