One of the major goals of GDPR is to discourage firms from retaining personal data in the first place. It did not used to cost them anything so they kept it regardless of its use. Now that there are big risks to keeping it these firms have to think twice about it.
This "cobra effect" is one more reason NOT to retain personal information in the first place.
This "cobra effect" is one more reason NOT to retain personal information in the first place.