There is also the fact that GDPR cannot overrule industry specific regulations that mandate long-term retention. I work in gambling industry, and we are requir

There is also the fact that GDPR cannot overrule industry specific regulations that mandate long-term retention. I work in gambling industry, and we are required by the regulations to keep ALL user information, including the KYC documents they submit, on file for a minimum of 5 years after their last activity. If you are looking for toxic data stores, this is among the worst ones there is. Limiting access to that data is crucial, and making sure it's not misused is mandatory. It could be worse. There are domains with more demanding data retention requirements: insurance and consumer finance in particular.