Could you explain? Keeping the information for a reasonable amount of time for security or fraud-detection purposes would definitely fall under legitimate inte

Could you explain? Keeping the information for a reasonable amount of time for security or fraud-detection purposes would definitely fall under legitimate interest. I really don't see any bad outcome happening from doing the reasonable thing. Enforcement is near non-existent (Google and Facebook are still around after all), and when it does happen it still very much skews towards assuming good faith (even when it shouldn't) so you'll definitely be fine even if you get it wrong in which case you'll just be given guidance on how to do better.