The French DPA fined a French company for not having a retention period, keeping personal data since 2007. In fact they were using an out of date hashtag, not actually deleting data after data subject request. The CNIL fined the company 120.000 € for not taking all necessary measures to be compliant.
