That's why GDPR complying webservers either disable logs or keep them on a rotating 30 day basis (a real legitimate interest to have insight into potential DDoS attacks).

Now you can take a guess how many actually do either of those two things... I would not even put it at above 1%.