GDPR already says companies should only keep data they actually need. Breaches like this suggest the fines still aren't big enough to change how they behave.