Access logs for one thing are pretty unreasonable to force people to avoid storing.
>Existing systems were built on the assumption that "misappropriating" PII was a lucrative thing to do. This led to abuse from the industry.
Can you point out a specific example of somebody suffering actual damages from this "abuse?"
I think it is certainly possible to find cases of identity theft resulting from PII that were leaked in security breaches, made easier by overreaching data collection.
Store them for a limited time, it's not hard.
Sometimes it's important to update regulations, despite the inertia of existing implementations.
As the first offense only seems to result in a warning, they have a chance to figure things out. Then is asking their webdev to schedule a cron job to delete logs really such a burden?