Note that this only addresses the lawfulness of the processing under Article 6 GDPR, which itself is only one of the required principles relating to the proces

Note that this only addresses the lawfulness of the processing under Article 6 GDPR, which itself is only one of the required principles relating to the processing of personal data that must be upheld under Article 5. Other principles that must be upheld, for example, are data minimization (lit c) or storage minimization (lit e). I know that one of the supervisory authorities has already ruled that the principle of data minimization trumps the lawfulness argument of "legitimate interests" in certain cases. Certain records must be destroyed when the legally mandated terms for keeping them have expired (eg 7 years).