When past data collection is confirmed to be illegal, this should apply retrospectively. That is: it means that they don't have consent to lawfully process the

When past data collection is confirmed to be illegal, this should apply retrospectively. That is: it means that they don't have consent to lawfully process the data they currently hold despite any coerced "I consent" clicks they might have received, so they should be required to destroy it without any further processing in addition to any other penalties.