I was asked to implement a new feature in a piece of our software for users to be able to schedule themselves for deletion (we auto-remove expired users with an automated overnight process). If a user wants to be deleted, they can click a button in their profile screen to be deleted within the next 24 hours (in the next batch).
My manager wants me to implement an "export" feature into the automated process so we can export users into our other system before they have been deleted, where they can be anonymised in there for reporting since some of our customers need to be able to report user's religions to be legally compliant in Ireland - not the user's details, just a total count of protestant vs catholic users.
He advises me that we are allowed to export their data (thus keeping their data in our other system) and still be GDPR compliant. I worry that this will actually make us non-compliant since I don't feel that data needs to be added to the report or leave the system in the first place. I fear it is unethical to implement such a feature.
What can I do in this situation without putting my job security on the line? Am I allowed to refuse to do this work because I feel it is unethical or potentially illegal? If so, what precautions can I take?
EDIT: I live in the UK. Our customer is Irish