What if law defined the processes more closely? “Billing data must be kept for 2 years numerically and 10 years on an offline device or paper. Marketing data can be kept for 6 months until renewal of consent by the user. The rest is permitted upon license.”
in other words if you lose the right to process or possess the data at all.
“corporate death penalty” kinds of regulation needs to happen more often