One thing I didn't see mentioned is that it directly violates the data minimization principle, they collected data they should not have needed and they kept it

One thing I didn't see mentioned is that it directly violates the data minimization principle, they collected data they should not have needed and they kept it around way longer than needed. Yes, they should have updated their config, but why did you need a resume full of private info to join, and why did you not delete it after the membership is approved (let alone keeping it for decades).