The gdal-data package has been in "held back" status for about a week so I got curious to see what was going on with it. Here is what I found and what I did:
The new package being held back is ver. 3.0.4+dfsg-1. The installed package on your system is probably 3.0.2+dfsg-1, or possibly 2.4.3+dfsg-1.
On a "spare" system, I used apt to remove the existing gdal-data. Then I used apt to install gdal-data and it was happy to install the new version. It then reported that I have the following packages installed that I can use "autoremove" to remove:
libaec0 libarmadillo9 libarpack2 libcharls2 libdap25 libdapclient6v5 libepsilon1 libfreexl1 libfyba0 libgdcm2.8
libgeos-3.8.0 libgeos-c1v5 libgeotiff5 libgraphicsmagick++-q16-12 libgraphicsmagick-q16-3 libhdf4-0-alt libhdf5-103
libkmlbase1 libkmldom1 libkmlengine1 libnetcdf13 libodbc1 libogdi4.1 libopencv-core3.2 libopencv-imgproc3.2
libproj15 libqhull7 libsocket++1 libspatialite7 libsuperlu5 libsz2 libtbb2 liburiparser1 odbcinst odbcinst1debian2
proj-bin proj-data
I used autoremove and removed them. Working with the system, I see no harm and no loss of functions that I need. I don't use graphicsmagick or the other packages named, so there's no harm to me. Your situation may be different.